curator.yml

client:
        hosts:
                ${ES_HOST}
        timeout: 1800
  ---
  actions:
        1:
                action: shrink
                description: shrink them indices
                options:
                        shrink_node: DETERMINISTIC
                        node_filters:
                                permit_masters: True
                        number_of_replicas: 0
                        post_allocation:
                                allocation_type: exclude
                                key: node_tag
                                value: hot
                        extra_settings:
                                settings:
                                        index.mapping.total_fields.limit: 10000
                        ignore_empty_list: True
                filters:
                        - filtertype: pattern
                          kind: regex
                          value: '(logstash|metricbeat|heartbeat|apm)(-\d\.\d\.\d)?-\d{4}\.\d{2}\.\d{2}'
                        - filtertype: age
                          source: creation_date
                          direction: older
                          unit: weeks
                          unit_count: 9
        2:
                action: forcemerge
                description: force merge shrunk indices
                options:
                        max_num_segments: 1
                        timeout_override: 21600
                        delay: 120             
                        ignore_empty_list: True   
                filters:
                        - filtertype: pattern
                          kind: regex
                          value: '(logstash|metricbeat|heartbeat|apm)(-\d\.\d\.\d)?-\d{4}\.\d{2}\.\d{2}-shrink'