ELK-定期清除数据

#!/bin/bash # @Author: richard # @Date:   2017-08-11 17:27:49 # @Last Modified by:   richard # @Last Modified time: 2017-08-11 18:04:58    #保留近 N 天 KEEP_DAYS=7    # 删除前 N的所有天到 前N+10天==>每天执行 function get_todelete_days() {     # declare -A DAY_ARR     # DAY_ARR=""     for i in $(seq 1 10);     do         THIS_DAY=$(date -d "$(($KEEP_DAYS+$i)) day ago" +%Y.%m.%d)         DAY_ARR=( "${DAY_ARR[@]}" $THIS_DAY)     done        echo ${DAY_ARR[*]}    }    # 返回数组的写法 TO_DELETE_DAYS=(`get_todelete_days`)    for day in "${TO_DELETE_DAYS[@]}" do     echo "$day will be delete"       curl -XDELETE 'http://127.0.0.1:9200/*-'${day} done

　　

写到 crontab 里面去

1 2	crontab -l 1 1 * * * /home/admin/elasticsearch/es_clear.sh

　　

 看看效果 只保留最近 7 天

---------------  更新 ---------------------

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

#!/bin/bash # @Author: richard # @Date:   2017-08-11 17:27:49 # @Last Modified by:   richard # @Last Modified time: 2017-08-11 18:04:58 # 用于es中日志索引的定时删除 # 保留近 N 天 KEEP_DAYS=7 # 删除最近 M 天，即删除是从 M+N到N DEL_DAYS=10 # 删除索引名，留空则使用*-日期(*-2021.02.20) INDEX_NAME=() # todo 需保留的索引名,留空则使用 # 删除前 N的所有天到 前N天==>每天执行 function get_todelete_days() {     # declare -A DAY_ARR     # DAY_ARR=""     for i in $(seq $DEL_DAYS $(($KEEP_DAYS+$DEL_DAYS)));     do         THIS_DAY=$(date -d "$i day ago" +%Y.%m.%d)         DAY_ARR=( "${DAY_ARR[@]}" $THIS_DAY)     done     echo ${DAY_ARR[*]} } # 返回数组的写法 TO_DELETE_DAYS=(`get_todelete_days`) for day in "${TO_DELETE_DAYS[@]}" do     if [ ${#INDEX_NAME[@]} -eq 0 ]; then       L_INDEX_NAME=( "${L_INDEX_NAME[@]}" "*-"${day} )     else       for each in "${INDEX_NAME[@]}"       do         L_INDEX_NAME=( "${L_INDEX_NAME[@]}" "${each}-${day}" )       done     fi done for l_index in "${L_INDEX_NAME[@]}" do       echo -n "$l_index will be delete"       curl -XDELETE -u"elastic:elastic#" 'http://127.0.0.1:9200/'$l_index       echo "" done

　　

　　

# sh clean.sh
nginx_access-2021.02.21 will be delete{"acknowledged":true}
nginx_error-2021.02.21 will be delete{"acknowledged":true}
nginx_access-2021.02.20 will be delete{"acknowledged":true}
nginx_error-2021.02.20 will be delete{"acknowledged":true}
nginx_access-2021.02.19 will be delete{"acknowledged":true}
nginx_error-2021.02.19 will be delete{"acknowledged":true}
nginx_access-2021.02.18 will be delete{"acknowledged":true}
nginx_error-2021.02.18 will be delete{"acknowledged":true}