elasticsearch历史数据清理

环境

• es为docker单机启动，版本7.1.1

实施

1.查看是否支持通配符批量删除索引（false=支持，true=不支持）

curl -X GET "172.168.1.116:9200/_cluster/settings?pretty"
{
  "persistent" : {
    "action" : {
      "destructive_requires_name" : "false"
    }
  },
  "transient" : { }
}

2.如果为true执行

curl -H "Content-Type: application/json" -XPUT ‘172.168.1.116:9200/_cluster/settings‘ -d ‘{"persistent": {"action.destructive_requires_name": "false"}}‘

3.查看所有索引

curl -X GET "172.168.1.116:9200/_cat/indices?v"

4.修改destructive_requires_name=false后执行如下命令

curl -X DELETE "172.168.1.116:9200/filebeat-7.1.1-2021.02*?pretty"

• 说明: 172.168.1.116:9200 改为实际的es地址和端口，filebeat-7.1.1-2021.02 改为实际的索引名,是通配符

检查

- 清理前es目录大小
du -sh elasticsearch/data/
50G elasticsearch/data/
- 清理后es目录大小
du -sh elasticsearch/data/
4.9G    elasticsearch/data/

定时处理

参考

• https://www.qikegu.com/docs/3063
• https://www.elastic.co/guide/cn/elasticsearch/guide/current/retiring-data.html
• https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html#delete-index-api-path-params
• https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-update-settings.html

elasticsearch历史数据清理

原文：https://blog.51cto.com/674564591/2674666