elasticsearch 删除N天前的索引脚本

#!/bin/sh


function delIndex()
{
        index_name=$1
        savedays=$2
        while [ $savedays -le $3 ]
        do

                format_day='%Y.%m.%d'
                sevendayago=`date -d "-${savedays} day " +${format_day}`
                index=$index_name$sevendayago
                #echo $sevendayago
                echo $index
                curl -XDELETE "http://127.0.0.1:9200/${index}"
                #exit 0
                savedays=`expr $savedays + 1`
        done
}

function closeIndex()
{
        index_name=$1
        savedays=$2
        while [ $savedays -le $3 ]
        do

                format_day='%Y.%m.%d'
                sevendayago=`date -d "-${savedays} day " +${format_day}`
                index=$index_name$sevendayago
                #echo $sevendayago
                echo $index
                curl -XPOST "http://127.0.0.1:9200/${index_name}/_close?pretty"
                #exit 0
                savedays=`expr $savedays + 1`
        done
}
closeIndex 'logstash-' 10 20
delIndex 'logstash-' 50 100

将上面的代码保存为sh文件，然后加到crontab里就可以每天删除10a天~100天前的数据了