是否可以从elasticsearch中实时自动删除超过10天的数据？

Question

curl -XGET '127.0.0.1:9200/messages/message/_search?pretty'返回如下所示的数据。我想知道是否有可能自动删除elasticsearch中超过10天的数据，最好是实时删除？我添加了我的示例数据，因为有一个字段date可以在本例中使用。或者可能有一种不同的更推荐的方法？

{
  "took" : 22,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 2,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "messages",
        "_type" : "message",
        "_id" : "1",
        "_score" : 1.0,
        "_source" : {
          "message" : "example message1"
        }
      },
      {
        "_index" : "messages",
        "_type" : "message",
        "_id" : "ZODslt0LZ1T6GMrC",
        "_score" : 1.0,
        "_source" : {
          "date" : "2018-05-25T10:06:06Z",
          "message" : "example message1"
        }
      }
    ]
  }
}

Answer 1

Elastic Curator正是您正在寻找的。您应该为每天的索引创建一个单独的文件。

例如，如果你的索引有这样的模式：YOUR_INDEX_NAME-%{+YYYY.MM.dd}，那么你应该应用下面的配置：

actions:
  1:
    action: delete_indices
    options:
      ignore_empty_list: True
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: YOUR_INDEX_NAME-
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'  <--- date pattern in your index name
      unit: days
      unit_count: 10          <--- after how many days delete the index