1、我的需求

xpack为ES集群提供了全面的监控，但其采集到的监控内容会消耗系统宝贵的内存磁盘资源，需要自定义清除策略。原理是：crontab定时请求ES集群暴露的HTTP删除接口删除指定日志索引

2、shell-删除监控日志索引

#!/bin/bash
#功能说明：ES监控插件xpack每天会产生两个索引如.monitoring-es-6-2019.01.30 及.watcher-history-7-2019.01.01，前者默认7天删除，后者默认不自动删除
#特别是前者占用较多磁盘及内存,需要自定义这些索引的清除周期
####################################################
#指定这些索引的保存周期
keep_days=1;
DATA=`date -d "$keep_days days ago" +%Y.%m.%d`
echo "将删除"$DATA"前的监控日志索引"
#指定ES集群中的任意一个节点的ip
node_ip=1XX.XX.XX.X67
time=`date`
#ES用户名及密码
user=elastic
password=4xxxxxxxxxxxxx9
#删除记录日志
delete_log=~/cronjob/logs/xpack_monitorLog_index_delete.log

#定义删除指定天数前的xpack监控日志monitoring索引方法
function doDleteXpackMonitorings() {
monitorings=`curl -XGET -u $user:$password http://$node_ip:9200/_cat/indices |grep '.monitoring-es'|awk {'if(substr($3,18)<"'$DATA'")  print $3'}`
for VAR in ${monitorings[@]}; do
  echo $VAR
 curl -XDELETE -u $user:$password  http://$node_ip:9200/$VAR
 if [ $? -eq 0 ]; then
     echo $time"-->成功删除xpack监控日志索引"$VAR >> $delete_log
 else
     echo $time"-->WARNNING!!!删除xpack监控日志索引失败"$VAR >> $delete_log
 fi
done
}


#定义删除指定天数前的xpack监控日志watcher索引方法
function doDleteXpackWatchers() {
watchers=`curl -XGET -u $user:$password http://$node_ip:9200/_cat/indices |grep '.watcher-history'|awk {'if(substr($3,20)<"'$DATA'")  print $3'}`
for VAR in ${watchers[@]}; do
 echo $VAR
 curl -XDELETE -u $user:$password  http://$node_ip:9200/$VAR
 if [ $? -eq 0 ]; then
     echo $time"-->成功删除xpack监控日志索引"$VAR >> $delete_log
 else
     echo $time"-->WARNNING!!!删除xpack监控日志索引失败"$VAR >> $delete_log
 fi
done
}


#启动删除方法
doDleteXpackMonitorings;
doDleteXpackWatchers;
echo "*****查看删除后监控日志索引请执行:curl -XGET -u "$user":"$password "http://"$node_ip":9200/_cat/indices |grep -E 'monitoring-es|watcher'"