Index lifecycle before the disk fills, not after

Daily indices grow linearly and nothing removes them, so a logging cluster works beautifully for four months and then stops accepting writes with a disk watermark error at the least convenient moment.

# curator, on a schedule, from day one
actions:
  1:
    action: delete_indices
    filters:
      - filtertype: age
        source: name
        timestring: '%Y.%m.%d'
        unit: days
        unit_count: 30

Thirty days is a decision about what questions you expect to answer, and it is worth making explicitly rather than by running out of space. The watermark behaviour is the part to know: at 85% Elasticsearch stops allocating new shards, at 95% it makes indices read-only, and clearing the second requires an API call after freeing the disk — it does not recover on its own.