logstash_purge_old_indexes.php

#!/usr/bin/php
<?php

#
# Quick and dirty script to purge old logstash indexes. The scripts tries hard to avoid deleting indexes that has other origins than logstash.
# Use at own risk.
#

$BASEURL = 'http://localhost:9200/';

class quickrest {

    var $baseurl;

    var $decoder;

    function __construct($baseurl) {
		$this->baseurl = $baseurl;
    }

    function getUrl($resource) {
	    return $this->baseurl.$resource;
    }

    function setDecoder($decoder) {
        $this->decoder = $decoder;
    }

    function request($method, $resource) {
	    $context = stream_context_create(array('http' =>
            array(
	            'method'  => $method,
            )
	    ));
	    $ret = file_get_contents($this->getUrl($resource), false, $context);
	    if(empty($this->decoder)) return $ret;
	    $decoder = $this->decoder;
	    return $decoder($ret);
    }

    function get($resource) {
	    return $this->request('GET', $resource);
    }

    function delete($resource) {
	    return $this->request('DELETE', $resource);
    }
}

$rest = new quickrest($BASEURL);
$rest->setDecoder('json_decode');

$indexes = array_keys(get_object_vars($rest->get('_status')->indices));
rsort($indexes);
//var_dump($indexes);

$max_days_try = 40;
$min_days_try = 14;
$index_format = "logstash-%Y.%m.%d";

for($d = $min_days_try; $d <= $max_days_try; $d ++) {
    $time = mktime(0,0,0,date('n'), date('j')-$d);
    $index_name = strftime($index_format, $time);

    if(in_array($index_name, $indexes)) {
        echo "Fant indexen $index_name! Sletter...\n";
        var_dump($rest->delete($index_name));
    } else {
        //var_dump($index_name);
    }
}