shrink.yml

actions:
  1:
    action: shrink
    description: >-
      Shrink logstash indices older than 21 days on the node with the most
      available space, excluding the node named 'not_this_node'.
      Delete each source index after successful shrink, then reroute the shrunk
      index with the provided parameters.
    options:
      disable_action: False
      ignore_empty_list: True
      shrink_node: DETERMINISTIC
      node_filters:
        permit_masters: True
        exclude_nodes: ['not_this_node']
      number_of_shards: 1
      number_of_replicas: 0
      shrink_prefix:
      shrink_suffix: '-shrink'
      delete_after: True
      post_allocation:
        allocation_type: include
        key: node_tag
        value: cold
      wait_for_active_shards: 1
      extra_settings:
        settings:
          index.codec: best_compression
      wait_for_completion: True
      wait_interval: 9
      max_wait: -1
    filters:
    - filtertype: pattern
      kind: prefix
      value: apacheaccess-2017.09.04
    - filtertype: age
      source: creation_date
      direction: older
      unit: days
      unit_count: 14