Elasticsearch通過elasticsearch-curator 插件來定期刪除Index

Elasticsearch管理中索引的管理非常重要。基於磁碟空間和性能的考量，索引的生命周期管理顯得尤為重要。Curator允許對索引創建、刪除等操作，下麵是我們藉助 elasticsearch-curator 插件來定期刪除index.本文主要介紹elasticsearch-curator 插件的安裝步驟。

Step 1下載

https://www.elastic.co/guide/en/elasticsearch/client/curator/current/yum-repository.html

 Step 2 上傳安裝包至伺服器，並創建相應的文件

Step 3 安裝

執行的安裝命令如下：

yum localinstall elasticsearch-curator-5.8.1-1.x86_64.rpm

Step 4  完善更新配置文件

 config.yml文件

詳細內容如下：

---
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
client:
  hosts:
    - 201.101.101.101
  port: 埠
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  http_auth: 用戶名:密碼
  timeout: 30
  master_only: False

logging:
  loglevel: INFO
  logfile: /data/elasticsearch-curator/log/curator.log
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

action.yml 文件的編輯

 詳細內容如下：

---
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True.  If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
    action: delete_indices
    description: >-
      Delete metric indices older than 3 days (based on index name), for
      .monitoring-es-6-
      .monitoring-kibana-6-
      .monitoring-logstash-6-
      .watcher-history-3-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
 #     disable_action: True
    filters:
    - filtertype: pattern
      kind: regex
      value: '^mysql-.*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 3

  2:
    action: close
    description: >-
      Close indices older than 30 days (based on index name), for syslog-
      prefixed indices.
    options:
      ignore_empty_list: True
      delete_aliases: False
#      disable_action: True
    filters:
    - filtertype: pattern
      kind: prefix
      value: syslog-
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 30

  3:
    action: forcemerge
    description: >-
      forceMerge syslog- prefixed indices older than 2 days (based on index
      creation_date) to 2 segments per shard.  Delay 120 seconds between each
      forceMerge operation to allow the cluster to quiesce. Skip indices that
      have already been forcemerged to the minimum number of segments to avoid
      reprocessing.
    options:
      ignore_empty_list: True
      max_num_segments: 2
      delay: 120
      timeout_override:
      continue_if_exception: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: syslog-
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 2
    - filtertype: forcemerged
      max_num_segments: 2
      exclude:

Step 5 使用crontab定期執行curator

設置定時任務，例如以下的crontab

6 0 * * * curator --config /data/elasticsearch-curator/config.yml /data/elasticsearch-curator/action.yml