elasticsearch歷史數據清理

elasticsearch歷史數據清理-手動方式清理

環境

• es爲docker單機啓動，版本7.1.1

實施

1.查看是否支持通配符批量刪除索引（false=支持，true=不支持）

curl -X GET "172.168.1.116:9200/_cluster/settings?pretty"
{
  "persistent" : {
    "action" : {
      "destructive_requires_name" : "false"
    }
  },
  "transient" : { }
}

2.若是爲true執行

curl -H "Content-Type: application/json" -XPUT '172.168.1.116:9200/_cluster/settings' -d '{"persistent": {"action.destructive_requires_name": "false"}}'

3.查看全部索引

curl -X GET "172.168.1.116:9200/_cat/indices?v"

4.修改destructive_requires_name=false後執行以下命令

curl -X DELETE "172.168.1.116:9200/filebeat-7.1.1-2021.02*?pretty"

• 說明: 172.168.1.116:9200 改成實際的es地址和端口，filebeat-7.1.1-2021.02 改成實際的索引名,是通配符

檢查

- 清理前es目錄大小
du -sh elasticsearch/data/
50G elasticsearch/data/
- 清理後es目錄大小
du -sh elasticsearch/data/
4.9G    elasticsearch/data/

定時處理

參考

• https://www.qikegu.com/docs/3063
• https://www.elastic.co/guide/cn/elasticsearch/guide/current/retiring-data.html
• https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html#delete-index-api-path-params
• https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-update-settings.html