Question

在Centos 7中使用Elasticsearch 5.1和Curator版本是4.3

我在Elasticsearch中有一些索引，其命名格式为sample.data.YYYY_MM_DD，sample.file.YYYY_MM_DD 例如：-

sample.data.2019_07_22
sample.data.2019_07_23
sample.data.2019_07_25
sample.data.2019_07_26
sample.data.2019_07_28
sample.file.2019_07_21
sample.file.2019_07_25
sample.file.2019_07_26
sample.file.2019_07_29

我曾经在Linux中使用以下命令来运行操作文件。

策展人--config /root/config.yml /root/action_file.yml

我想删除所有索引，除了最近创建的新索引[sample.data.2019_07_28，sample.file.2019_07_29]

这是我尝试过的：-

  ---
  actions:
   1:
    action: delete_indices
    description: "Delete indices older than 3 days (based on index name), for workflow- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly."
    filters:
      - 
        exclude: ~
        filtertype: pattern
        kind: prefix
        value: sample.*.
      - 
        direction: older
        exclude: ~
        filtertype: age
        source: name
        timestring: "%Y%m%d"
        unit: days
        unit_count: 3
    options:
      continue_if_exception: false
      disable_action: false
      ignore_empty_list: true
      timeout_override: ~

即使我也使用了以下功能，它也会删除总体索引

- filtertype: count
  count: 4

预期输出为：-

sample.data.2019_07_28
sample.file.2019_07_29

Answer 1

我认为您应该将timestring从timestring: "%Y%m%d"更改为timestring: "%Y_%m_%d"。当我进行空转测试时，我得到：

2019-08-02 15:02:47,493 INFO      Preparing Action ID: 1, "delete_indices"
2019-08-02 15:02:47,513 INFO      Trying Action ID: 1, "delete_indices": Delete indices older than 3 days (based on index name), for workflow- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2019-08-02 15:02:48,709 INFO      DRY-RUN MODE.  No changes will be made.
2019-08-02 15:02:48,709 INFO      (CLOSED) indices may be shown that may not be acted on by action "delete_indices".
2019-08-02 15:02:48,709 INFO      DRY-RUN: delete_indices: sample.file.2019_07_26 with arguments: {}
2019-08-02 15:02:48,709 INFO      DRY-RUN: delete_indices: sample.file.2019_07_27 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_28 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_29 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_30 with arguments: {}
2019-08-02 15:02:48,710 INFO      Action ID: 1, "delete_indices" completed.
2019-08-02 15:02:48,710 INFO      Job completed.

希望有帮助。

Answer 2

我认为您应该升级到Curator 5.7，它fully supports Elasticsearch v5，并提供count filter，可以按年龄对索引进行排序，并且仅保留 n 个索引。使用exclude flag，您可以排除最近的索引，然后使用常规的年龄过滤器。

Elasticsearch Curator在按过滤器类型删除索引时不删除最后一个索引

2 个答案: