其实也可以通过es的生命周期进行管理

安装curator

配置yum源/etc/yum.repos.d/curator.repo

[curator-5]
name=CentOS/RHEL 7 repository for Elasticsearch Curator 5.x packages
baseurl=https://packages.elastic.co/curator/5/centos/7
gpgcheck=1
gpgkey=https://packages.elastic.co/GPG-KEY-elasticsearch
enabled=1

通过yum安装

$ yum install elasticsearch-curator

配置curator

configfile配置参考官方configfile

---
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
client:
  hosts:
    - 192.168.31.10
    - 192.168.31.11
    - 192.168.31.12
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  http_auth:
  timeout: 600
  master_only: False

logging:
  loglevel: DEBUG
  logfile: #/home/curator/curator.log
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

action.yml配置包含四个部分

• action 操作
• description 描述
• options 参数
• filters 匹配方式

示例

删除索引

actions:
  1:
    action: delete_indices
    description: "删除过期索引"
    options:
      # action开关，为True表示不执行这个action，默认False
      disable_action: False
      # 如果为True，则在filters空列表时，继续下一个action处理而不是退出程序。
      ignore_empty_list: True
      # 发现错误后，继续执行下一个索引操作，默认False
      continue_if_exception: True
    filters:
    # 是否排除隐藏索引，如.kibana
    - filtertype: kibana
      exclude: True
    # 是否排除open状态的索引
    - filtertype: opened
      exclude: True
    # 处理30天前的索引
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 30
      exclude: False

分配调度

actions:
  1:
    action: allocation
    description: "Apply shard allocation filtering rules to the specified indices"
    options:
      key: box_type
      value: warm
      allocation_type: require
      wait_for_completion: true
      continue_if_exception: true
      disable_action: false
    filters:
    - filtertype: pattern
      kind: prefix
      value: traefik-
      exclude: False
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 6
      exclude: False

和

actions:
  1:
    action: allocation
    description: "Apply shard allocation filtering rules to the specified indices"
    options:
      disable_action: False
      key: box_type
      value: warm
      allocation_type: require
      wait_for_completion: False
      # 发现错误后，继续执行下一个索引操作
      continue_if_exception: True
      ignore_empty_list: True
    filters:
    - filtertype: pattern
      kind: prefix
      value: nginx_kong-
      exclude: False
    - filtertype: period
      source: name
      timestring: '%Y.%m.%d'
      unit: days
      range_from: -22
      range_to: -22
      exclude: False

段落合并

actions:
  1:
    action: delete_indices
    description: "删除过期索引"
    options:
      # action开关，为True表示不执行这个action，默认False
      disable_action: False
      # 如果为True，则在filters空列表时，继续下一个action处理而不是退出程序。
      ignore_empty_list: True
      # 发现错误后，继续执行下一个索引操作，默认False
      continue_if_exception: True
    filters:
    # 是否排除隐藏索引，如.kibana
    - filtertype: kibana
      exclude: True
    # 是否排除open状态的索引
    - filtertype: opened
      exclude: True
    # 处理30天前的索引
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 30
      exclude: False