Deleting Elasticsearch Indices By Timestamp

It needs two files. One of them is curator config.yml whose names is curator.yml and second file whose name is test-delete-indices.yml.

YAML-based Curator Configuration

Elasticsearch host which is in environment, must be written like above 127.0.0.1 if it is in local.

curator.yml

client:
  hosts:
    - 127.0.0.1
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  http_auth:
  timeout: 30
  master_only: False

logging:
  loglevel: DEBUG
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

test-delete-indices.yml

actions:
1:
    action: delete_indicex
    description: >-
        Delete access indices
    options:
        ignore_empty_list: True
        timeout_override:
        continue_if_exception: False
        disable_action: False
    filters:
    - filtertype: pattern
     kind: prefix
     value: test-first-incides_
     exclude:
    - filtertype: age
     source: name
     direction: older
     timestring: '%Y%m%d'
     unit: days
     unit_count: 3
     exclude:

Once the two YAML files are configured, you can initiate a dry run of curator execution with following command.

curator /path/test-delete-indices.yml --config /path/curator.yml --dry-run

The --dry-run mode will not actualy delete the index. It can be used to verify the output of the action.

Once the dry run verification is completed, you can schedule the actual run in cron, using crontab -e as shown below.

*/5 * * * * sh /usr/local/eops/eops_check.sh > /dev/null 2>&1 &
*/1 * * * * curator /path/test-delete-indices.yml --config /path/curator.yml >> /path/log.log

Note: /path/.. must be written correctly as located.
Note: Result of these commands are written log.log file.

It will be all indices after before 3 days.

test-first-incides_20210526
test-first-incides_20210525
test-first-incides_20210524
test-first-incides_20210523 will be deleted
test-first-incides_20210522 will be deleted
...
...