Currently doing some work on logstash and found myself wanting to delete indexes over a certain age. The following PHP script gets the job done. I use php as my primary command line scripting language so use or port as interested.
#!/usr/bin/php <?php date_default_timezone_set("America/Chicago"); $index_name = "logstash-"; $purge_age = 300; $elastic = "http://elastic.domain.com:9200"; $data = file_get_contents("${elastic}/_cat/indices/${index_name}*"); foreach(split("\n", $data) as $line) { $split = preg_split("/\s+/", $line); if(count($split) > 1) { $date = preg_replace("/${index_name}|\./", "", $split[2]); $split[] = floor((time() - strtotime($date)) / 60 / 60 / 24); $indexes[$date] = $split; } } if($purge_age > 0) { foreach($indexes as $nd => $index) { if($index[10] > $purge_age) { $url = sprintf("%s/%s", $elastic, $index[2]); printf("Purging %s with $url\n", $nd, $url); $c = curl_init(); curl_setopt($c, CURLOPT_RETURNTRANSFER, true); curl_setopt($c, CURLOPT_CUSTOMREQUEST, "DELETE"); curl_setopt($c, CURLOPT_URL, $url); $result = curl_exec($c); // result should be {"acknowledged":true} curl_close($c); } } } asort($indexes); print_r($indexes); ?>