elasticsearch集群容量总是有限的，所以必需要对超过一定时间的索引进行删除和清理。
先说明下我们索引的命令方式：xxx-xxx-xxx-yyyy.mm.dd
yyyy.mm.dd为日期。
清理脚本如下：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
#!/bin/bash ################################### #删除早于天的ES集群的索引 ################################### # crontab -e #clean es index #* 0 * * * sh /data/shell/clean_es_indes.sh #索引保存天数 days=30 #ES cluster url es_cluster_url="http://127.0.0.1:9200" function delete_indices() { comp_date=`date -d "$days day ago" +"%Y-%m-%d"` date1="$1 00:00:00" date2="$comp_date 00:00:00" t1=`date -d "$date1" +%s` t2=`date -d "$date2" +%s` if [ $t1 -le $t2 ]; then echo "$1时间早于$comp_date，进行索引删除" #转换一下格式，将类似2017-10-01格式转化为2017.10.01 format_date=`echo $1| sed 's/-/\./g'` echo "curl -XDELETE $es_cluster_url/*$format_date" curl -s -XDELETE "$es_cluster_url/*$format_date" fi } curl -s -XGET "$es_cluster_url/_cat/indices" | awk -F" " '{print $3}' | awk -F"-" '{print $NF}' | egrep "[0-9]*\.[0-9]*\.[0-9]*" | sort | uniq | sed 's/\./-/g' | while read LINE do #调用索引删除函数 delete_indices $LINE done |
另一个脚本，适用于日期时间格式为xxxx-2019-10-08的索引：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
#!/bin/bash searchIndex=console-log elastic_url=10.16.16.36 elastic_port=9200 save_days=7 date2stamp () { date --utc --date "$1" +%s } dateDiff (){ case $1 in -s) sec=1; shift;; -m) sec=60; shift;; -h) sec=3600; shift;; -d) sec=86400; shift;; *) sec=86400;; esac dte1=$(date2stamp $1) dte2=$(date2stamp $2) diffSec=$((dte2-dte1)) if ((diffSec < 0)); then abs=-1; else abs=1; fi echo $((diffSec/sec*abs)) } for index in $(curl -s "${elastic_url}:${elastic_port}/_cat/indices?v" | grep -E " ${searchIndex}-20[0-9][0-9]-[0-1][0-9]-[0-3][0-9]" | awk '{ print $3 }'); do date=$(echo ${index: -10} | sed 's/\./-/g') cond=$(date +%Y-%m-%d) diff=$(dateDiff -d $date $cond) #echo -n "${index} (${diff})" if [ $diff -gt $save_days ]; then echo "curl -XDELETE \"${elastic_url}:${elastic_port}/${index}?pretty\"" curl -XDELETE "${elastic_url}:${elastic_port}/${index}?pretty" else echo "skip delete index: ${index}" fi done |
参考：
https://blog.csdn.net/felix_yujing/article/details/78207667