First of all, create a configuration file. This file specifies which indexes to delete.
/opt/elasticsearch-curator/actions/delete.yml
An example of the content of such a file can be explained as below:
actions:
1:
action: delete_indices
description: >-
Delete indices older than 30 days (based on index name), for logstash-
prefixed indices. Ignore the error if the filter does not result in an
actionable list of indices (ignore_empty_list) and exit cleanly.
options:
ignore_empty_list: True
timeout_override:
continue_if_exception: False
disable_action: True
filters:
- filtertype: pattern
kind: prefix
value: logstash-
exclude:
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 30
exclude:
In order for the action to be performed cyclically, you must add the command to crontab.
* 1 * * * /usr/bin/curator --config /opt/elasticsearch-curator/.curator/curator.yml /opt/elasticsearch-curator/actions/delete.yml > /dev/null 2>&1
Before running the command, test the curator's operation by adding a flag:
--dry-run
