0

在 Centos 7 中使用 Elasticsearch 5.1 和 Curator 版本是 4.3

我在弹性搜索中有一些索引，其命名格式为 sample.data.YYYY_MM_DD ， sample.file.YYYY_MM_DD 例如：-

sample.data.2019_07_22
sample.data.2019_07_23
sample.data.2019_07_25
sample.data.2019_07_26
sample.data.2019_07_28
sample.file.2019_07_21
sample.file.2019_07_25
sample.file.2019_07_26
sample.file.2019_07_29

我曾经在 Linux 中使用以下命令来运行操作文件。

策展人 --config /root/config.yml /root/action_file.yml

我想删除所有索引，但最近创建的索引较新 [sample.data.2019_07_28, sample.file.2019_07_29]

这是我尝试过的：-

  ---
  actions:
   1:
    action: delete_indices
    description: "Delete indices older than 3 days (based on index name), for workflow- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly."
    filters:
      - 
        exclude: ~
        filtertype: pattern
        kind: prefix
        value: sample.*.
      - 
        direction: older
        exclude: ~
        filtertype: age
        source: name
        timestring: "%Y%m%d"
        unit: days
        unit_count: 3
    options:
      continue_if_exception: false
      disable_action: false
      ignore_empty_list: true
      timeout_override: ~

即使我也使用了以下功能，它也会删除整体索引，

- filtertype: count
  count: 4

预期输出如下： -

sample.data.2019_07_28
sample.file.2019_07_29
4

2 回答 2

1

我认为您应该将您的timestringfrom更改timestring: "%Y%m%d"为timestring: "%Y_%m_%d". 当我进行空运行测试时，我得到：

2019-08-02 15:02:47,493 INFO      Preparing Action ID: 1, "delete_indices"
2019-08-02 15:02:47,513 INFO      Trying Action ID: 1, "delete_indices": Delete indices older than 3 days (based on index name), for workflow- prefixed indices. Ignore the error if the filter does not result in an actionable list of indices (ignore_empty_list) and exit cleanly.
2019-08-02 15:02:48,709 INFO      DRY-RUN MODE.  No changes will be made.
2019-08-02 15:02:48,709 INFO      (CLOSED) indices may be shown that may not be acted on by action "delete_indices".
2019-08-02 15:02:48,709 INFO      DRY-RUN: delete_indices: sample.file.2019_07_26 with arguments: {}
2019-08-02 15:02:48,709 INFO      DRY-RUN: delete_indices: sample.file.2019_07_27 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_28 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_29 with arguments: {}
2019-08-02 15:02:48,710 INFO      DRY-RUN: delete_indices: sample.file.2019_07_30 with arguments: {}
2019-08-02 15:02:48,710 INFO      Action ID: 1, "delete_indices" completed.
2019-08-02 15:02:48,710 INFO      Job completed.

希望有帮助。

于 2019-08-02T13:03:19.960 回答
0

我认为您应该升级到完全支持 Elasticsearch v5并提供计数过滤器的 Curator 5.7，它可以按年龄对索引进行排序，并且只保留n 个索引。使用排除标志，您可以排除最近的索引，然后使用常规年龄过滤器。

于 2019-08-02T17:20:40.450 回答