An issue occurs when attempting to create an action in Index Management.

hxshira

I am trying to create an action in Index Management to delete indices that are older than 3 months. The syntax for the action appears to be correct, but when I click 'Verify' or 'Save', an error occurs. I am using version 7.4.2 of the system. The error prevents the action from being created successfully, even though there don't seem to be any issues with the syntax.

SzymonC

I'm happy to help, but I don't think I've seen that one before. Let's try to see what's this about.
For the first step can you show me the whole configuration of the rule?
(For Firefox brower I use Fireshot plugin to snapshot whole html page)

hxshira

SzymonC

Hm, I cannot replicate that, but don't worry.
In general if you select Prefix or Suffix option you don't need a wildcard at the end. So siem will work just as well and you don't usually need that * at the end. Could you verify if the outcome is any different if you will put only siem in option Pattern filter value?

hxshira

SzymonC the same

SzymonC

OK, so I've reached to our DEVs and so far most likely scenario is that password might have some special signs that service is trying to take into account.
Probably there's no need to change it, but first you might trying to do some escape signs there according to YAML syntax. Please, let me know if that is the case!

hxshira

SzymonC could this characters in password "/&.{<>=)" cause a problem?

SzymonC

Yes. In some cases it might be an issue. Specially { or [ when combined somewhere with '.