刪除elasticsearch大於7天前的索引

curl -u 用戶名:密碼  -H'Content-Type:application/json' -d'{
    "query": {
        "range": {
            "@timestamp": {
                "lt": "now-7d",
                "format": "epoch_millis"
            }
        }
    }
}
' -XPOST "http://127.0.0.1:9200/*-*/_delete_by_query?pretty"

{
    "query": {
        "range": { //范圍
            "@timestamp": {//時間字段
                "lt": "now-7d",//lt是小於(<)，lte是小於等於(<=),gt是大於(>),gte是大於等於(>=),now-7d是當前時間減7天
                "format": "epoch_millis"
            }
        }
    }
}　　

定時刪除

$ crontab -e

* 0 * * * /usr/bin/curl -u username:password  -H'Content-Type:application/json' -d'{"query":{"range":{"@timestamp":{"lt":"now-7d","format":"epoch_millis"}}}}' -XPOST "http://127.0.0.1:9200/*-*/_delete_by_query?pretty" 

k8s cronJob

apiVersion: batch/v1beta1
kind: CronJob
metadata:
 name: elasticsearch
 namespace: elasticsearch
 labels:
   app.kubernetes.io/name: elasticsearch
spec:
  successfulJobsHistoryLimit: 10 
  failedJobsHistoryLimit: 10
  concurrencyPolicy: Forbid #禁止並發運行
  schedule: "0 1 * * *"
  jobTemplate: #運行一個job
    spec:
      template:
        metadata:
          name: del-es-index-cronjob
        spec:
          restartPolicy: OnFailure
          imagePullSecrets:
          - name: regsecret
          containers:
          - name: curl-es
            image: shansongxian/alpine-data-curl:latest
            command:
            - "/bin/sh"
            - "-c"
            - >
              curl -X DELETE http://elasticsearch:9200/*`date +%Y.%m.%d -d "-7 days"`?pretty