删除elasticsearch大于7天前的索引

curl -u 用户名:密码  -H'Content-Type:application/json' -d'{
    "query": {
        "range": {
            "@timestamp": {
                "lt": "now-7d",
                "format": "epoch_millis"
            }
        }
    }
}
' -XPOST "http://127.0.0.1:9200/*-*/_delete_by_query?pretty"

{
    "query": {
        "range": { //范围
            "@timestamp": {//时间字段
                "lt": "now-7d",//lt是小于(<)，lte是小于等于(<=),gt是大于(>),gte是大于等于(>=),now-7d是当前时间减7天
                "format": "epoch_millis"
            }
        }
    }
}　　

定时删除

$ crontab -e

* 0 * * * /usr/bin/curl -u username:password  -H'Content-Type:application/json' -d'{"query":{"range":{"@timestamp":{"lt":"now-7d","format":"epoch_millis"}}}}' -XPOST "http://127.0.0.1:9200/*-*/_delete_by_query?pretty" 

k8s cronJob

apiVersion: batch/v1beta1
kind: CronJob
metadata:
 name: elasticsearch
 namespace: elasticsearch
 labels:
   app.kubernetes.io/name: elasticsearch
spec:
  successfulJobsHistoryLimit: 10 
  failedJobsHistoryLimit: 10
  concurrencyPolicy: Forbid #禁止并发运行
  schedule: "0 1 * * *"
  jobTemplate: #运行一个job
    spec:
      template:
        metadata:
          name: del-es-index-cronjob
        spec:
          restartPolicy: OnFailure
          imagePullSecrets:
          - name: regsecret
          containers:
          - name: curl-es
            image: shansongxian/alpine-data-curl:latest
            command:
            - "/bin/sh"
            - "-c"
            - >
              curl -X DELETE http://elasticsearch:9200/*`date +%Y.%m.%d -d "-7 days"`?pretty