Prune Elasticsearch indexes N days old - use cron.daily to execute once a day to keep only 90 days of indexes on Elasticsearch

prune-elasticsearch-filebeat.sh

#!/usr/bin/env bash
#
# Delete indexes from N days ago 
#
for arg in ${@} ; do case $arg in (-h|-\?) echo "USAGE: [INDEX_PREFIX=[filebeat]] $BASH_SOURCE [DAYS_AGO]" 1>&2 ; exit 255 ;; esac ; done

DAYS_AGO=${1:-90}

INDEX_PREFIX_DEFAULT="filebeat"

case $(uname -m) in
  (Darwin) YMD=$(date -j -v-${DAYS_AGO}d +%Y.%m.%d) ;;
  (Linux) YMD=$(date --date="${DAYS_AGO} days ago" +%Y.%m.%d) ;;
esac

# https://www.elastic.co/guide/en/elasticsearch/reference/current/_delete_an_index.html
curl -s -D - --user ${USERNAME}:${PASSWORD} \
  -X DELETE https://elasticsearch.example.com/${INDEX_PREFIX:=${INDEX_PREFIX_DEFAULT}}-${YMD}