定期删除ES过期索引

 

#!/bin/env bash

function del() {
        basic=`date -d '1 days ago' +%Y-%m-%d`

        date1="$basic 0:0:0"
        date2="$1 0:0:0"

        t1=`date -d "$date1" +%s`
        t2=`date -d "$date2" +%s`

        if [[ $t1 -ge $t2 ]];then
                format=`echo $1 | sed 's/-//g'`
                echo $format
                curl -XDELETE "slug:9200/*$format"
        fi
}

curl -XGET -s 'slug:9200/_cat/indices' | awk '{print $3}' | awk -F"_" '{print $NF}' | grep '[[:digit:]]\{8\}' | sort | uniq | while read line;do
        p="${line:0:4}-${line:4:2}-${line:6}"
        del $p
done

 

原始索引后缀

 

 

经过字符串处理传递给函数的索引

 

删除指定日期的indices

 

#!/bin/env bash

read -p "Input the address of the elk server:" ip
read -p "Input the day of the indexes you want to delete:" day

echo "searching..............."

DATE=`date --date "$day days ago" +"%Y%m%d"`

curl -s -XGET http://$ip:9200/_cat/indices?v | grep $DATE | awk -F'[ ]+' '{print $3}'
echo '****************************************************************************'

echo -ne "do you want to delete the indices?\033[31;46m y(delete)/n(exit)\033[0m:"
read choice

if [[ ${choice} == 'y' ]] || [[ ${choice} == 'Y' ]];then
        curl -XPOST "${ip}:9200/*_${DATE}/_forcemerge?only_expunge_deletes=true"
        curl -XDELETE "http://${ip}:9200/*_${DATE}"
        echo
        echo -e "\033[41;37m deleting is done\033[0m"
else
        echo -e "\033[33m nothing to be done\033[0m"
        exit 0
fi