logstath.conf 配置

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 5044
    codec => json_lines
  }
}
output {
  elasticsearch {
    hosts => ["elasticsearch.pai-cloud.svc.cluster.local:9200"]
    index => "honghu-%{+YYYY.MM.dd}"
  }
}

创建ILM策略

定义一个 ILM 策略，在 delete 阶段删除超过 7 天的索引。

PUT _ilm/policy/auto_delete_policy
{
  "policy": {
    "phases": {
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

创建索引模板

创建名为 honghu 的索引模板，并关联 生命周期策略 7-days-retention-policy。

PUT _index_template/honghu
{
  "template": {
    "settings": {
      "index": {
        "lifecycle": {
          "name": "auto_delete_policy"
        }
      }
    }
  },
  "index_patterns": [
    "honghu-*"
  ]
}

将 ILM 策略应用到索引

应用了 ILM 策略 7-days-retention-policy 到名为 honghu* 的索引。

PUT honghu*/_settings
{
    "index": {
        "lifecycle": {
            "name": "auto_delete_policy"
        }
    }
}

设置生命周期轮询间隔

通过 PUT /_cluster/settings 修改集群设置，将生命周期管理的轮询间隔时间设置为 30 秒。

PUT /_cluster/settings
{
  "transient": {
    "indices.lifecycle.poll_interval":"30s"
  }
}