GET /_cat/indices?v

DELETE /filebeat-2018.07.21

#!/bin/bash

# filename:deleteEsData.sh

# 每天2点定时删除es中指定日期的数据

# crontab: 0 2 * * * sh /Application/enterprise/deengine/deleteEsData.sh >> /Application/enterprise/deengine/run.log 2>&1

# 如今天是2015-09-09，删除3天前数据，就是删除2015-09-06的数据

# createdate: 20150909

# author: yuanlong.zhou

today=`date +%Y-%m-%d`;

echo "今天是${today}"

# 获得要删除的日期

# 不指定参数时，默认删除30天前以aaa-开头的数据（因为是凌晨删除，所以不含当天）

daynum=5

# 当参数个数大于1时，提示参数错误

if [ $# -gt 1 ] ;then

        echo "要么不传参数，要么只传1个参数!"

        exit 101;

fi

# 当参数个数为1时，获取指定的参数

if [ $# == 1 ] ;then

        daynum=$1

fi

esday=`date -d '-'"${daynum}"' day' +%Y-%m-%d`;

echo "${daynum}天前是${esday}"

curl -XDELETE http://localhost:9200/aaa-*-${esday}

echo "${today}执行完成"

# echo curl -XDELETE http://localhost:9200/aaa-*-${esday}

filter {

multiline {

pattern => "^\d{4}-\d{1,2}-\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}"

negate => true

what => "previous"

}

}