（三）如何通过命令管理ELK索引

• 查看集群状态

[root@node06 logstash]# curl -i -XGET http://ip:9200/_cat/nodes?pretty
HTTP/1.1 200 OK
content-type: text/plain; charset=UTF-8
content-length: 108

192.168.159.134 22 81 0 0.00 0.03 0.05 mdi * es-node1
192.168.159.130 16 96 1 0.04 0.20 0.14 mdi - es-node2

• 查看集群信息

http://ip:9200/_cat/nodes?v

• 查看索引信息

curl 'ip:9200/_cat/indices?v'

• 删除单个索引

curl -XDELETE ip:9200/tomcat-access-2020.11.12

• 删除全部索引

curl -XDELETE 192.168.159.134:9200/* 或者
curl -XDELETE 192.168.159.134:9200/_all

编写删除索引脚本

vim delete_es_index.sh
#!/bin/bash
#此脚本删除90天以上的es索引
#d_time为找出索引结尾为2019.03.01格式索引
d_time=$(date -d '-90days' +'%Y.%m.%d')
#m_time为找出索引结尾为2019.03的格式索引
m_time=$(date -d '-90days' +'%Y.%m')
 
/usr/bin/curl -XDELETE http://192.168.90.24:9200/*-${d_time}
/usr/bin/curl -XDELETE http://192.168.90.24:9200/*-${m_time}


curl -X DELETE http://xx.xx.com:9200/logstash-*-`date +%Y-%m-%d -d "-$n d