Elasticsearch indices deletion (+ closing)

There are 2 options to optimize elasticsearch storage. We use it in ELK stack. 

The easiest way to do this is to use curator. 

Location: /usr/local/bin/curator

Main config: --config /home/ubuntu/.curator/curator.yml

 main curator config

client:
hosts:
- 127.0.0.1
port: 9200
url_prefix:
use_ssl: False
certificate:
client_cert:
client_key:
ssl_no_validate: False
http_auth:
timeout: 30
master_only: False

logging:
loglevel: INFO
logfile: /var/log/curator.log
logformat: default
blacklist: ['elasticsearch', 'urllib3']

Actions: 

/home/ubuntu/.curator/actions/close.yml 

 close.yml config

actions:
  1:
    action: close
    description: >-
      Close indices older than 45 days (based on index name), for logstash-
      prefixed indices.
    options:
      delete_aliases: False
      timeout_override:
      continue_if_exception: False
      disable_action: False
    filters:
    - filtertype: pattern
      kind: prefix
      value: logstash-
      exclude:
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 45
      exclude:

/home/ubuntu/.curator/actions/delete_indices.yml 

 delete_indices.yml config

actions:

  1:

    action: delete_indices

    description: >-

      Delete indices older than 60 days (based
on index name), for logstash-

      prefixed indices. Ignore the error if the
filter does not result in an

      actionable list of indices
(ignore_empty_list) and exit cleanly.

    options:

      ignore_empty_list: True

      timeout_override:

      continue_if_exception: False

      disable_action: False

    filters:

    - filtertype: pattern

      kind: prefix

      value: logstash-

      exclude:

    - filtertype: age

      source: name

      direction: older

      timestring: '%Y.%m.%d'

      unit: days

      unit_count: 60

      exclude:

1) Closing indices. 

It will "forget" (mark them as not important and won't use) all indices, older than X days. They are not deleted, so it won't free up space, but it will work faster. After that,  Indices could be "warmed" again, if needed. 

2) Deletion. 

It will delete all indices, older than X days. Deletes indices to clean space. 

Crontab for ROOT :

20 0 * * * /usr/local/bin/curator --config /home/ubuntu/.curator/curator.yml /home/ubuntu/.curator/actions/close.yml >> /var/log/curator.log 2>&1   50 2 * * * /usr/local/bin/curator --config /home/ubuntu/.curator/curator.yml /home/ubuntu/.curator/actions/delete_indices.yml >> /var/log/curator.log 2>&1