一、编写脚本

[root@ES-Log-1 ~]# vim delete_es_indices.sh 
#!/bin/bash
#主机IP
host_ip="172.16.1.24:9200"
#超过10天的索引将要删除
delete_overday=10


function del_red_indices(){
for i in `curl "${host_ip}/_cat/indices?v" |grep red |awk '{print $3}'`
do
  sudo -u es sh -c "curl -XDELETE 'http://${host_ip}/$i'"> /dev/null
  echo "$i is deleted!"
done
}

function del_indices_daily() {
     comp_date=`date -d "${delete_overday} day ago" +"%Y-%m-%d"`
     date1="$1 00:00:00"
     date2="$comp_date 00:00:00"
 
     t1=`date -d "$date1" +%s`
     t2=`date -d "$date2" +%s`
 
     if [ $t1 -le $t2 ]; then
        echo "$1时间早于$comp_date，进行索引删除"
        #转换一下格式，将类似2017-10-01格式转化为2017.10.01
        format_date=`echo $1| sed 's/-/\./g'`
        echo $format_date
        sudo -u es sh -c "curl -XDELETE 'http://${host_ip}/*${format_date}'"> /dev/null
     fi
 }


del_red_indices

curl -XGET http://${host_ip}/_cat/indices | awk -F" " '{print $3}' | awk -F"-" '{print $NF}' | egrep "[0-9]*\.[0-9]*\.[0-9]*" | sort | uniq  | sed 's/\./-/g' | while read LINE
do
    #调用索引删除函数
    del_indices_daily $LINE
done

二、添加执行权限

[root@ES-Log-1 ~]# chmod +x delete_es_indices.sh

三、写入定时任务

[root@ES-Log-1 ~]# crontab  -e
# delete es index
45 23 * * * /usr/bin/sh /root/delete_es_indices.sh &> /dev/null &