ElasticSearch Indice Purge Script

elasticsearch-indice-purge.rb

#!/usr/bin/env ruby
require 'net/http'
require 'json'
require 'date'

enable = true # set to false for dry run
retention_days = 30 # retention period

today_date = Date.today
deleted_any = false

# es host details
es_host = nil # update es host ip address
es_port = 9200

fail "update es_host value" unless es_host

# es connection
es_conn_headers    = {
  'Accept' => 'application/json',
  'Keep-Alive' => '120',
  'Content-Type' => 'application/json'
}

es_conn = Net::HTTP.new(es_host, es_port)

# get indices list
indices_url = '/_all/_settings?pretty'
reply = es_conn.request(Net::HTTP::Get.new(indices_url, es_conn_headers))

if reply.code == '200'
  indices = JSON.parse(reply.body)

  indices.each do |name, options|
    # skip elastalert and kibana indices
    next if name =~ /^elastalert_status|^.kibana/
    creation_date = Time.at( options['settings']['index']['creation_date'].to_i / 1000 ).to_date
    days_older = (today_date - creation_date).to_i

    # delete if older than x days
    if days_older > retention_days
      deleted_any = true
      if enable
        delete_indice_url = "/#{name}"
        delete_reply = es_conn.request(Net::HTTP::Delete.new(delete_indice_url, es_conn_headers))
        if delete_reply.code == '200'
          puts "deleted indice \e[31m#{name}\e[0m (#{days_older}days older), created on \e[31m#{creation_date}\e[0m"
        else
          puts "failed to delete indice \e[31m#{name}\e[0m (#{days_older}days older), created on \e[31m#{creation_date}\e[0m, '#{delete_reply.code}' - #{delete_reply.body}"
        end
      else
        puts "would delete indice \e[31m#{name}\e[0m (#{days_older}days older), created on \e[31m#{creation_date}\e[0m"
      end
    end
  end
  puts "no indice found older than \e[31m#{retention_days}days\e[0m" if !deleted_any
else
  fail "got a non 200 OK response '#{reply.code} - #{reply.body}'"
end