Elastic curator安装及使用

pip install elasticsearch-curator

curator --version
curator, version 5.8.4

curator_cli --host 10.0.0.1:9200 --http_auth 'user:password' show-indices

curator_cli --host 10.0.0.1:9200 --http_auth 'user:password' delete-indices --filter_list '[{"filtertype": "pattern", "kind": "prefix", "value": "filebeat-"}, {"filtertype": "age", "source": "name", "direction": "older", "timestring": "%Y.%m.%d", "unit": "days", "unit_count": 7}]'

# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
client:
  hosts:
    - 10.0.0.1
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  username: elastic
  password: password
  timeout: 30
  master_only: False

logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

delete.action
actions:
  1:
    action: delete_indices
    description: "delete apm indices before 30 days."
    options:
      ignore_empty_list: True
      disable_action: False
      continue_if_exception: False
      allow_ilm_indices: True
    filters:
    - filtertype: kibana
      exclude: True
    - filtertype: pattern
      kind: regex
      value: '^(\.monitoring-).*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 30

close.action
actions:
  1:
    action: close
    description: "close apm indices before 15 days."
    options:
      ignore_empty_list: True
      disable_action: False
      continue_if_exception: False
      allow_ilm_indices: True
    filters:
    - filtertype: kibana
      exclude: True
    - filtertype: pattern
      kind: regex
      value: '^(\.monitoring-).*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 15

snapshot.action
actions:
  1:
    action: snapshot
    description: >-
      Snapshot indices prefixed indices older than 1 day
    options:
      repository: backup_s3_repository
      name: '<prod-log-backup-{now/d-1d}>'
      ignore_unavailable: False
      include_global_state: True
      partial: False
      wait_for_completion: True
      skip_repo_fs_check: False
      allow_ilm_indices: True
    filters:
    - filtertype: pattern
      kind: regex
      value: '^(\.monitoring-).*$'
      exclude: True
    - filtertype: pattern
      kind: regex
      value: '.*(stag).*$'
      exclude: True
    - filtertype: period
      source: name
      range_from: -1
      range_to: -1
      timestring: '%Y.%m.%d'
      unit: days

delete_snapshot.action
actions:
  1:
    action: delete_snapshots
    description: >-
      Delete snapshots from the selected repository older than 365 days
    options:
      repository: backup_s3_repository
      disable_action: False
      allow_ilm_indices: True
    filters:
    - filtertype: pattern
      kind: regex
      value: '^(prod-log-backup-).*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 365

forcemerge.action
actions:
  1:
      action: forcemerge
    description: >-
      forceMerge syslog- prefixed indices older than 2 days (based on index
      creation_date) to 2 segments per shard.  Delay 120 seconds between each
      forceMerge operation to allow the cluster to quiesce. Skip indices that
      have already been forcemerged to the minimum number of segments to avoid
      reprocessing.
    options:
      ignore_empty_list: True
      max_num_segments: 2
      delay: 120
      timeout_override:
      continue_if_exception: False
    filters:    - filtertype: pattern
      kind: prefix
      value: syslog-
      exclude:    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 2
    - filtertype: forcemerged
      max_num_segments: 2

actions:
  1:
    action: create_index
    description: "创建索引名为：'nginx-%Y-%m-%d-%H:%M:%S'的索引"
    options:
      name: nginx-%Y-%m-%d-%H:%M:%S #索引名称
      extra_settings:    #索引信息
        settings:
          number_of_shards: 2
          number_of_replicas: 1
        mappings:
          student:
            _routing:
              required: true
            properties:
              name:
                type: keyword
              age:
                type: integer

curator --config config.yml action.yml