curator 索引管理工具

索引管理工具curator安装并使用：

 

下载curator安装包

scp elasticsearch-curator-5.8.1-1.x86_64.rpm 到对应机器上

rpm -ivh elasticsearch-curator-5.8.1-1.x86_64.rpm

curator --version 查看是否安装成功

curator_cli --http_auth elastic:elastic --host 10.128.40.180 --port 9200 show_indices --verbose

#查看所有索引

curator_cli --http_auth elastic:elastic --host 10.128.40.180 --port 9200 close --filter_list '[{"filtertype":"age","source":"creation_date","direction":"older","unit":"days","unit_count":1},{"filtertype":"pattern","kind":"prefix","value":"101_"}]'

#关闭前一天的索引

 

默认配置文件位置：

/opt/elasticsearch-curator/

 

手动创建配置文件：

 

配置my-config.yml

cd /opt/elasticsearch-curator/

[root@VM_40_180_centos elasticsearch-curator]# cat my-config.yml

#Rmember,leave a key empty if there is no value. None will be a string,

#not a Python "NoneType"

client:

hosts:

- 10.128.40.180

port: 9200

url_prefix:

use_ssl: False

certificate:

client_cert:

client_key:

ssl_no_validate: False

http_auth:

timeout: 30

master_only: False

ssl_no_validate: false

http_auth: "elastic:elastic"

logging:

loglevel: INFO

logfile: /opt/elasticsearch-curator/log/wyh-curator.log

logformat: default

blacklist: ['elasticsearch', 'urllib3']

 

配置my-action.yml

 

[root@VM_40_180_centos elasticsearch-curator]# cat my-action.yml

#Remember, leave a key empty if there is no value. None will be a string,

# not a Python "NoneType"

 

#Also remember that all examples have 'disable_action' set to True. If you

#want to use this action as a template, be sure to set this to False after

#copying it.

 

actions:

1:

action: delete_indices

description: >-

Delete metric indices older than 6 months (based on index name), for

3144_2020.04.15

prefixed indices. Ignore the error if the filter does not result in an

actionable list of indices (ignore_empty_list) and exit cleanly.

options:

disable_action: False

ignore_empty_list: True

continue_if_exception: True

filters:

- filtertype: kibana

exclude: True

- filtertype: opened

exclude: False

- filtertype: pattern

kind: prefix

value: '^\d{2,4}.*_sharememory.*$'

exclude: False

- filtertype: age

source: creation_date

direction: older

unit: minutes

unit_count: 5

exclude: False

 

[root@VM_40_180_centos elasticsearch-curator]# cat my-action_yongyan.yml

#Remember, leave a key empty if there is no value. None will be a string,

# not a Python "NoneType"

 

#Also remember that all examples have 'disable_action' set to True. If you

#want to use this action as a template, be sure to set this to False after

#copying it.

 

actions:

1:

action: delete_indices

description: >-

Delete metric indices older than 6 months (based on index name), for

3144_2020.04.15

prefixed indices. Ignore the error if the filter does not result in an

actionable list of indices (ignore_empty_list) and exit cleanly.

options:

disable_action: False

ignore_empty_list: True

continue_if_exception: True

filters:

- filtertype: kibana

exclude: True

- filtertype: opened

exclude: False

- filtertype: pattern

kind: prefix

value: '^\d{2,4}.*_yongyan.*$'

exclude: False

- filtertype: age

source: name

direction: older

timestring: '%Y.%m.%d'

unit: days

unit_count: 1

exclude: False

 

 

删除脚本：

[root@VM_40_180_centos elasticsearch-curator]# cat curator-delete-index.sh

#!/bin/sh

/usr/bin/curator --config /opt/elasticsearch-curator/my-config.yml /opt/elasticsearch-curator/my-action.yml

echo "delete index success"

 

定时任务：

#*/1 * * * * /opt/elasticsearch-curator/curator-delete-index.sh > /dev/null 2>&1 &

#* * */1 * * /opt/elasticsearch-curator/curator-delete-index_yongyan.sh > /dev/null 2>&1 &

 

踩坑总结：

curator 支持年月日时分索引删除  根据官方文档 支持source不同可实现删除索引功能

官网地址：https://www.elastic.co/guide/en/elasticsearch/client/curator/current/filtertype_age.html

 

手动启动命令：

curator --config /opt/elasticsearch-curator/my-config.yml /opt/elasticsearch-curator/my-action.yml

curator_cli --http_auth elastic:elastic --host 10.128.40.180 --port 9200 show_indices --verbose