在不使用 curator 的情况下，如何删除或过期在我的案例中是旧示例的索引 30 天旧索引需要自动删除

Question

我想删除比今天早 30 天的所有日志，示例 logstash 文件名如下

logstash-2016-11-30 

有没有我可以设置一个值的配置，它会自动删除旧数据。

哪个是更好的选项配置 (*.yml) 文件或触发查询。

Answer 1

对于 Curator 4.1.2，您可以使用 crontab 上的下一行：

00 00 * * * curator --config /etc/logstash/curator/curator.yml /etc/logstash/curator/delete

/etc/logstash/curator/curator.yml 是这样的

    # Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
client:
  hosts:
   - 127.0.0.1
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  aws_key:
  aws_secret_key:
  aws_region:
  ssl_no_validate: False
  http_auth:
  timeout: 30
  master_only: False

logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

和 /etc/logstash/curator/delete 就像：

    # Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True.  If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
  action: delete_indices
  description: >-
  #Delete older than 30 days
  options:
    ignore_empty_list: True
    timeout_override:
    continue_if_exception: False
    disable_action: False #True
  filters:
  - filtertype: pattern
    kind: prefix
    value: logstash-
    exclude:
  - filtertype: age
    source: creation_date
    direction: older
    unit: days
    unit_count: 30
    exclude:

您可以创建新操作并使用其他“年龄”过滤器，例如秒、分钟...

Answer 2

Curator 4.2.3 重新引入了 Curator 3.x 中存在的命令行单例。你可以阅读更多here。

curator_cli [ARGS] delete-indices --filter_list '...'