internally, es has marked the old document as deleted and added an entirely new document. the old version of the document doesn’t disappear immediately, although you wont be able to access it. es clean up deleted documents in the background as you continue to index more data。
function delete_index(){
index_prefix=$1
save_day=$2
cd $datadir
for file in `find ./ -type d -name "${index_prefix}*" -mtime +${save_day}`
do
curl -XDELETE $(hostname -i):9200/$(basename $file)
#如：curl -XDELETE 127.0.0.1:9200/logstash-apache-2015-12-31
done
}
4 个回复
zttech
赞同来自: PJ 、soltex
DELETE /test/test/_query
{
"query":{
"match_all":{}
}
}
zttech
赞同来自: tompanda
tompanda
赞同来自:
您说的方式我之前就试过, 但是没有成功, 所以很困惑
yinglunfeng - 90后系统工程师
赞同来自:
比如存储apache日志的索引logstash-apache-2015.12-31
你可以直接进入es的数据目录查找N天前修改的目录（目录就是索引名），然后利用curl -XDELETE ip:9200/索引名进行删除。在linux中结合计划任务的话，可以写一个类似如下的脚本定期删除：
#!/bin/bash
datadir="/home/elk/elasticsearch/data/UCWeb_foxy/nodes/0/indices"
function delete_index(){
index_prefix=$1
save_day=$2
cd $datadir
for file in `find ./ -type d -name "${index_prefix}*" -mtime +${save_day}`
do
curl -XDELETE $(hostname -i):9200/$(basename $file)
#如：curl -XDELETE 127.0.0.1:9200/logstash-apache-2015-12-31
done
}
#第一个参数为要删除的索引类型，第二个参数索引保存天数
delete_index logstash-u2 5
delete_index logstash-u3 5
delete_index logstash-ping 90