cron_job_to_delete_old_indicies.pp

# list of severity levels
# ["emergency", "alert", "critical", "error", "warning", "notice", "informational", "debug"]


cron { 'Clean_debug_older_than_4_weeks_28_days':
command => '/usr/local/bin/purge_elasticsearch.sh -d 28 -l debug',
minute => '10',
hour => '5',
}
cron { 'Clean_informational_older_than_16_weeks_112_days':
command => '/usr/local/bin/purge_elasticsearch.sh -d 112 -l informational',
minute => '20',
hour => '5',
}
cron { 'Clean_notice_older_than_32_weeks_224_days':
command => '/usr/local/bin/purge_elasticsearch.sh -d 224 -l notice',
minute => '30',
hour => '5',
}
cron { 'Clean_all_older_than_1_year_365_days':
command => '/usr/local/bin/purge_elasticsearch.sh -d 365',
minute => '40',
hour => '5',
}

purge_elasticsearch.sh

#!/bin/bash
# elasticsearch cleanup  script

ES_BASEDIR='/var/lib/elasticsearch/asimov/nodes/0/indices'
ES_HTTP='http://localhost:9200'
RETENTION_PERIOD='365'
LOG_REDIRECT='&>/dev/null'
LOGLEVEL='clean'


usage(){
cat <<EOF
usage: $0 <options>

  -l loglevel to clean 
  -d number of days to keep content
  -h show this help message
  -p set path to elasticsearch index dir
  -u set url to elasticsearch http interface
  -v verbose

EOF
}

while getopts 'l:d:hp:u:v' OPTION
do
  case $OPTION in

    d) RETENTION_PERIOD=$OPTARG;;
    h) usage && exit 0;;
    l) LOGLEVEL=$OPTARG;;
    p) ES_BASEDIR=$OPTARG;;
    u) ES_HTTP=$OPTARG;;
    v) unset LOG_REDIRECT;;
  esac
done

cd $ES_BASEDIR
INDICES=`find -maxdepth 1 -type d -ctime +$RETENTION_PERIOD | grep -v kibana |sed 's/\.\///'`

for INDEX in $INDICES; do
  if [ -z "$LOG_REDIRECT" ];then
    if [ "$LOGLEVEL" == 'clean' ];then
      curl -s -XDELETE $ES_HTTP/$INDEX/
    else
      curl -s -XDELETE $ES_HTTP/$INDEX/_query  -d "
        {\"query\": {
          \"filtered\": {
            \"filter\": {
              \"bool\": {
                \"must\": [
                  {
                    \"terms\": {
                      \"severity_label\": [
                        \"$LOGLEVEL\"
      ]}}]}}}}}"
    fi

  else
    if [ "$LOGLEVEL" == 'clean' ];then
      curl -s -XDELETE $ES_HTTP/$INDEX/ &>/dev/null
    else
      curl -s -XDELETE $ES_HTTP/$INDEX/_query  -d "
        {\"query\": {
          \"filtered\": {
            \"filter\": {
              \"bool\": {
                \"must\": [
                  {
                    \"terms\": {
                      \"severity_label\": [
                        \"$LOGLEVEL\"
                      ]
      }}]}}}}}" &>/dev/null
    fi
  fi
done