securityonion-elastic: curator won't delete closed indices

[dougburks]

No description provided.

[weslambert]

Adding more info...Curator will not delete closed indices via our current method of deleting by disk_space, however, there is the option to use a custom script, or delete by a number of days as an alternative.

[dougburks]

Security-Onion-Solutions/securityonion-elastic#31

[dougburks]

submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/CDBWzS0OLU0/discussion

[dougburks]

published:
https://blog.securityonion.net/2018/11/elastic-642-and-updated-securityonion.html

[daniejstriata]

@dougburks Was this added only to the newer 16.04 images? I don't see the /usr/sbin/so-curator-closed-delete file installed on my 14.04 install and my /nsm volume is filling up with indices so much that I no longer more than a couple of days worth of Caps.
3.5T 3.1T 178G 95% /nsm

[dougburks]

Yes, /usr/sbin/so-curator-closed-delete is only available on Security Onion 16.04. 14.04 has reached End Of Life:
https://securityonion.net/wiki/eol