Pack provides many operations helping to manage your Elasticsearch indices. Current functionality is mostly based on curator.

Pack provides a set of actions based on curator.

Actions invocation parameters will be described further. But for more detailed description what each action actually does please also refer to the curator docs, it is more in-depth.

These parameters include general options such as elasticsearch host, port etc.

These parameters filter indices or snapshots when a command is being applied.

Search actions perform a specified query in Elasticsearch. There are two search actions available: search.q and search.body. The first one takes a query string (given in lucene syntax), while the former allows to perform more sophisticated searches using Elasticsearch query DSL.

Both search actions use the same common parameters as curator based actions.

This action is enhanced with index selection parameters to simplify indices matching.

Performing curator operations on indices or snapshots at least one filtering parameter must be specified. That's a generic rule applied to all of curator actions except show, show will act on all indices or snapshots if there aren't any other filtering options.

Now let's have at a few invocation examples.

• Show indices older than 2 days:

st2 run elastic.show.indices host=elk older_than=2 timestring=%Y.%m.%d

Shows this on my node:

{
    "result": null, 
    "exit_code": 0, 
    "stderr": "", 
    "stdout": "logstash-2015.05.02
logstash-2015.05.04
"
}

• Delete all indices matching ^logstash.*:

st2 run elastic.delete.indices host=elk prefix=logstash

• Create a snapshot of indices based on time range criteria:

st2 run elastic.snapshot host=elk repository=my_backup newer_than=20 older_than=10 timestring=%Y.%m.%d

This command will create a snapshot of indices newer than 20 days and older than 10 days. Notice that filtering parameters of snapshot command apply to indices not to snapshots. That's why it's important not to mess it up. For example, the timestring parameter when created by curator with default options has a different time scheme.

• Delete specific snapshots:

st2 run elastic.delete.snapshots host=elk repository=my_backup snapshot=curator-20150506155615,curator-20150506155619

• Delete all snapshots:

st2 run elastic.delete.snapshots host=elk repository=my_backup all_indices=true

On successful search (total hits > 0) query actions exit with return code == 0, if no documents have been found return code == 1. In all other case such as execution exceptions return code is 99.

Let's look at a few examples:

• Run query using DSL syntax:

st2 run elastic.search.body host=elk body='{"query":{"match_all":{}}}' pretty=true

• Run query using URI syntax where q is a Lucene string:

st2 run elastic.search.q host=elk q='message:my_log_event' prefix=logstash

• Author:: StackStorm (st2-dev) (info@stackstorm.com)
• Author:: Denis Baryshev (dennybaa@gmail.com)