Elasticsearch cleanup, courtesy of http://thejmlcontinuum.blogspot.com.

escleanup.sh

#!/bin/bash

# delete one day 
# curl -s -XDELETE  'http://127.0.0.1:9200/logstash-2014.02.28'

# delete from crontab
# DATETODELETE=`date +%Y.%m.%d -d '7 days ago'`
# curl -s -XDELETE  http://127.0.0.1:9200/logstash-${DATETODELETE}

# delete by space
DESIRED=250000000
AVAIL=`df /data|grep -v Filesystem|awk '{print $4}'`

if [ $AVAIL -lt $DESIRED ] 
then
    curl -s -XDELETE 127.0.0.1:9200/`curl -s 127.0.0.1:9200/_stats?pretty|grep logstash|sort|awk -F'"' '{ print $2 }'|head -n1`
fi