Elastic curator安装及使用

一、Curator的用途
1、索引生命周期管理，索引close、delete、snaoshot。

二、Curator版本与ES版本兼容要求

三、Curator工具安装
1、下载curator-5.8.1 RPM安装包

• 安装指导页面链接：https://www.elastic.co/guide/...
• curator工具rpm包下载地址：https://packages.elastic.co/c...

2、安装curator-5.8.1

rpm -ivh elasticsearch-curator-5.8.1-1.x86_64.rpm
curator --version

四、配置并执行操作
1、配置文件整理，curator.yml以及action

curator.yml
---
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
client:
  hosts:
    - 127.0.0.1
  port: 9200
  url_prefix:
  use_ssl: False
  certificate:
  client_cert:
  client_key:
  ssl_no_validate: False
  http_auth: elastic:123456
  timeout: 30
  master_only: False
 
logging:
  loglevel: INFO
  logfile:
  logformat: default
  blacklist: ['elasticsearch', 'urllib3']

delete.action
actions:
  1:
    action: delete_indices
    description: "close apm indices before 90 days."
    options:
      ignore_empty_list: True
      disable_action: False
      continue_if_exception: False
      allow_ilm_indices: True
    filters:
    - filtertype: kibana
      exclude: True
    - filtertype: pattern
      kind: regex
      value: '^(\.monitoring-).*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 30

close.action
actions:
  1:
    action: close
    description: "close apm indices before 15 days."
    options:
      ignore_empty_list: True
      disable_action: False
      continue_if_exception: False
      allow_ilm_indices: True
    filters:
    - filtertype: kibana
      exclude: True
    - filtertype: pattern
      kind: regex
      value: '^(\.monitoring-).*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 15

snapshot.action
actions:
  1:
    action: snapshot
    description: >-
      Snapshot indices prefixed indices older than 1 day
    options:
      repository: backup_s3_repository
      name: '<prod-log-backup-{now/d-1d}>'
      ignore_unavailable: False
      include_global_state: True
      partial: False
      wait_for_completion: True
      skip_repo_fs_check: False
      allow_ilm_indices: True
    filters:
    - filtertype: pattern
      kind: regex
      value: '^(\.monitoring-).*$'
      exclude: True
    - filtertype: pattern
      kind: regex
      value: '.*(stag).*$'
      exclude: True
    - filtertype: period
      source: name
      range_from: -1
      range_to: -1
      timestring: '%Y.%m.%d'
      unit: days

delete_snapshot.action
actions:
  1:
    action: delete_snapshots
    description: >-
      Delete snapshots from the selected repository older than 365 days
    options:
      repository: backup_s3_repository
      disable_action: False
      allow_ilm_indices: True
    filters:
    - filtertype: pattern
      kind: regex
      value: '^(prod-log-backup-).*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 365

2、运行action

/usr/bin/curator --config /etc/curator/curator.yml /etc/curator/action/delete.action