python脚本清理ELK指定数据

今天共享下ELK清理指定数据内容的python脚本，同样是使用kibana的dev tools为请求工具；
这个脚本也是生产环境中应用比较广泛并且非常实用的一个维护技巧，抛砖引玉分享给大家。

#!/usr/bin/evn python3
# -*-coding:utf-8-*-
# Author: zyjsuper
# Filename: elk_delete_by_query.py
# CreateTime: 2024/5/6 9:12

from requests import Session
session = Session()


login_url = "http://10.10.1.33:5601/auth/login"
login_headers = {
	"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.88 Safari/537.36",
	"osd-version": "2.3.0",
	"Content-Type": "application/json",
	"Accept": "*/*",
	"Origin": "http://10.10.1.33:5601",
	"Referer": "http://10.10.1.33:5601/app/login?nextUrl=%2Fapp%2Fhome",
	"Accept-Encoding": "gzip, deflate, br",
	"Accept-Language": "zh-CN,zh;q=0.9",
	"Connection": "close"
}

login_json={
	"password": "admin",
	"username": "admin"
}

delete_by_query_url = "http://10.10.1.33:5601/api/console/proxy?path=oa-nginx-access-%2A%2F_delete_by_query%3Frefresh%26conflicts%3Dproceed%26scroll_size%3D2000%26slices%3D10%26wait_for_completion%3Dfalse&method=POST"

delete_by_query_headers = {
	"Accept": "text/plain, */*; q=0.01",
	"osd-xsrf": "opensearchDashboards",
	"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.88 Safari/537.36",
	"Content-Type": "application/json",
	"Origin": "http://10.10.1.33:5601",
	"Referer": "http://10.10.1.33:5601/app/dev_tools",
	"Accept-Encoding": "gzip, deflate, br",
	"Accept-Language": "zh-CN,zh;q=0.9",
	"Connection": "close"
}

delete_by_query_json={
	"query": {
		"match": {
			"message": "login.do?userName="
		}
	}
}

session.post(login_url, headers=login_headers, json=login_json)
response = session.post(delete_by_query_url, headers=delete_by_query_headers, json=delete_by_query_json)

print(response.text)
复制

这个实例是以opensearch集群为例编写，elasticsearch换成对应的客户端，更改请求头信息即可。