Watcher (v5.5.1): Look for indices to purge every 24h with @timestamp older than 2 days

purge_indices.json

PUT _xpack/watcher/watch/purge_indices
{
  "trigger": {
    "schedule": {
      "interval": "24h"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": [
          "metricbeat-*"
        ],
        "body": {
          "size": 0,
          "aggs": {
            "indices": {
              "terms": {
                "field": "_index"
              },
              "aggs": {
                "last_timestamp": {
                  "max": {
                    "field": "@timestamp"
                  }
                },
                "aged_indices": {
                  "bucket_selector": {
                    "buckets_path": {
                      "lastTimestamp": "last_timestamp"
                    },
                    "script": "params.lastTimestamp < System.currentTimeMillis() - 2 * 24 * 3600 * 1000"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "inline": """
if (ctx.payload.aggregations.indices.buckets.size() < 1) return false; return true;
      """
    }
  },
  "transform": {
    "script": """
def results=ctx.payload.aggregations.indices.buckets.stream().map(i -> i.key).collect(Collectors.toList()); return ['results': results];
    """
  },
  "actions": {
    "delete_index": {
      "webhook": {
        "method": "DELETE",
        "host": "cluster.es.tld",
        "port": 9200,
        "scheme": "https",
        "path": "{{#join}}ctx.payload.results{{/join}}",
        "auth": {
          "basic": {
            "username": "elastic",
            "password": "changeme"
          }
        }
      }
    },
    "log_entry": {
      "logging": {
        "text": "[Watcher]: purging {{#join}}ctx.payload.results{{/join}}: older than 2 days"
      }
    }
  }
}

POST _xpack/watcher/watch/purge_indices/_execute
{
  "action_modes": {
    "_all": "force_simulate"
  }
}

Use with _rollover:

PUT _xpack/watcher/watch/rollover_metricbeat
{
  "trigger": {
    "schedule": {
      "interval": "24h"
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "https",
        "host": "cluster.es.tld",
        "port": 9200,
        "method": "post",
        "path": "/metricbeat/_rollover",
        "params": {},
        "headers": {},
        "auth": {
          "basic": {
            "username": "elastic",
            "password": "changeme"
          }
        },
        "body": """{"conditions": {"max_docs": 1000000}}"""
      }
    }
  },
  "condition": {
    "always": {}
  },
  "actions": {
    "log": {
      "logging": {
        "level": "info",
        "text": "[rollover] {{ctx.payload.old_index}} rollover to {{ctx.payload.new_index}}: {{ctx.payload.rolled_over}}"
      }
    }
  }
}