定期删除logstash在elasticsearch中的inde

编写shell如下:

ES_HOST="http://es:port"
LOGSTASH_INDEX_PATTERN="logstash-[0-9]{4}\.[0-9]{2}\.[0-9]{2}"

#入参为es index name
function check_index() {
  INDEX_NAME=$1
  #抽取index中的日期, 转换为yyyy-MM-dd
  CHECK_DATE=`echo $INDEX_NAME | egrep $LOGSTASH_INDEX_PATTERN | awk -F"-" '{print $NF}' | sed 's/\./-/g'`

  DELETE_BEFORE_DATE=`date -d "60 day ago" +"%Y-%m-%d"`

  DELETE_BEFORE_TIMESTAMP=`date -d "$DELETE_BEFORE_DATE" +%s` 
  CHECK_TIMESTAMP=`date -d "$CHECK_DATE" +%s` 

  if [ $CHECK_TIMESTAMP -le $DELETE_BEFORE_TIMESTAMP ]; then
    echo "$CHECK_DATE is older than $DELETE_BEFORE_DATE"
    echo "deleting $ES_HOST/$INDEX_NAME..."
    curl -XDELETE $ES_HOST/$INDEX_NAME
    echo "done"
  fi
}


echo ===============
echo `date`
echo ===============

curl -XGET $ES_HOST/_cat/indices  \
  | awk -F" " '{print $3}' \
  | egrep $LOGSTASH_INDEX_PATTERN \
  | sort | uniq \
  | while read INDEX_NAME 
do    
  check_index $INDEX_NAME
done 

假设命名为/root/purge.sh

编辑crontab:

crontab -e

输入

0 3 * * * /bin/sh /root/purge.sh >> /var/log/purge.log