ELK批量删除索引
存在问题
用了一段时间elk发现如果索引长时间不删除,elk会越来越慢,重启elasticsearch服务器节点之前同步时间也会很长
解决方法
第一步:在elasticsearch节点上使用curl -XGET 'http://192.168.X.XX:9200/_cat/shards'查看索引
[root@192-168-X-XXX ~]# curl -XGET 'http://192.168.X.X:9200/_cat/shards' |more % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 57452 100 57452 0 0 467k 0 --:--:-- --:--:-- --:--:-- 471k laravel-oms26-online-2017.08.02 1 r STARTED 48 101.8kb 192.168.X.X node2-192.168.X.X laravel-oms26-online-2017.08.02 1 p STARTED 48 101.8kb 192.168.X.XX node1-192.168.X.XX laravel-oms26-online-2017.08.02 4 r STARTED 65 118.1kb 192.168.X.XXX node3-192.168.X.XXX laravel-oms26-online-2017.08.02 4 p STARTED 65 118.1kb 192.168.X.XX node1-192.168.X.XX laravel-oms26-online-2017.08.02 2 p STARTED 42 61.4kb 192.168.X.X node2-192.168.X.X laravel-oms26-online-2017.08.02 2 r STARTED 42 61.4kb 192.168.X.XXX node3-192.168.X.XXX laravel-oms26-online-2017.08.02 3 r STARTED 52 130.5kb 192.168.X.XXX node3-192.168.X.XXX laravel-oms26-online-2017.08.02 3 p STARTED 52 130.5kb 192.168.X.XX node1-192.168.X.XX laravel-oms26-online-2017.08.02 0 p STARTED 37 105.2kb 192.168.X.X node2-192.168.X.X laravel-oms26-online-2017.08.02 0 r STARTED 37 105.2kb 192.168.X.XX node1-192.168.X.XX etl213-online-2017.08.01 1 r STARTED 649 244.6kb 192.168.X.XXX node3-192.168.X.XXX etl213-online-2017.08.01 1 p STARTED 649 244.6kb 192.168.X.XX node1-192.168.X.XX etl213-online-2017.08.01 4 r STARTED 673 295.3kb 192.168.X.X node2-192.168.X.X etl213-online-2017.08.01 4 p STARTED 673 295.3kb 192.168.X.XXX node3-192.168.X.XXX etl213-online-2017.08.01 2 r STARTED 663 264.1kb 192.168.X.X node2-192.168.X.X etl213-online-2017.08.01 2 p STARTED 663 264.1kb 192.168.X.XX node1-192.168.X.XX etl213-online-2017.08.01 3 p STARTED 640 280kb 192.168.X.X node2-192.168.X.X etl213-online-2017.08.01 3 r STARTED 640 280kb 192.168.X.XX node1-192.168.X.XX etl213-online-2017.08.01 0 r STARTED 670 286.2kb 192.168.X.XXX node3-192.168.X.XXX etl213-online-2017.08.01 0 p STARTED 670 286.2kb 192.168.X.XX node1-192.168.X.XX
第二步:过滤出想要删除的索引存到临时文件里面 curl -XGET 'http://192.168.X.X:9200/_cat/shards' |grep "2017\.08\.01" |grep 192.168.X.XX |awk '{print $1}' | uniq > elk-index.tmp
[root@192-168-X-XXX ~]# curl -XGET 'http://192.168.X.X:9200/_cat/shards' |grep "2017.08\.01" |grep 192.168.X.XX |awk '{print $1}' | uniq > elk-index.tmp % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 57452 100 57452 0 0 123k 0 --:--:-- --:--:-- --:--:-- 123k [root@192-168-X-XXX ~]# cat elk-index.tmp wcf.core50-online-2017.08.01 etl211-online-2017.08.01 laravel-dujia-online-2017.08.01 dms217-online-2017.08.01 laravel-oms27-online-2017.08.01
第三步:删除过滤出来的索引
for i in `cat elk-index.tmp` do curl -XDELETE http://192.168.X.X:9200/$i done
第四步为了方便可以在计划任务里面加定时任务删除五天之前的日志索引
[root@192-168-X-XXX ~]# crontab -l 0 3 * * * bash /home/scripts/del_elasticseatch_index.sh
查看脚本文件内容cat /home/scripts/del_elasticseatch_index.sh
#!/bin/bash #The index five days ago curl -XGET 'http://192.168.X.X:9200/_cat/shards' |grep 192.168.X.X |awk '{print $1}' |grep `date -d "5 days ago" +%Y.%m.%d` |uniq > /tmp/index_name.tmp for index_name in `cat /tmp/index_name.tmp` do curl -XDELETE http://192.168.X.X:9200/$index_name echo "${index_name} delete success" >> /home/scripts/del_elasticseatch_index.log done
志不强者智不达