ES Curator檢索管理組件

配置文件

主配置示例

# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
client:
  hosts:
    - ${ELASTIC_SEARCH_HOST:localhost}
  port: ${ELASTIC_SEARCH_PORT:9200}
  url_prefix:
  use_ssl: ${USE_SSL:True}
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: True
  http_auth:
  timeout: 30
  master_only: False

logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

Action配置示例

actions:
  1:
    action: delete_indices
    description: >-
      Delete indices older than 60 days (based on index name), for logstash-
      prefixed indices. Ignore the error if the filter does not result in an
      actionable list of indices (ignore_empty_list) and exit cleanly.
    options:
      ignore_empty_list: True
      disable_action: False
    filters:
        - filtertype: pattern
          kind: prefix
          value: ${INDEX_PREFIX:logstash-}
        - filtertype: age
          source: creation_date
          direction: older
          unit: days
          unit_count: ${DAYS_COUNT:60}

管理命令

curator --config config.yml action.yml

curator_cli --config config.yml show_indices --verbose

# 索引列表
curator_cli --host localhost --port 9200 show_indices --verbos

# 按期清理索引
curator_cli --host localhost --port 9200 [--http_auth 帳號:密碼] delete_indices --filter_list '{"filtertype":"pattern","kind":"regex","value":"log-2018.*.*"}'