Delete moloch session indices as per retention period in days when indices are created hourly. Very hacky and quick solution.

moloch_hourly_clean_daily.sh

#!/bin/bash

RETAINDAYS=7
HOST="localhost"
PORT=9200

INDICES=`curl -ss -XGET $HOST:$PORT/_cat/indices?v | awk -F " " '{print $3}' | grep sessions | sort -n`
TODAY=`date +"%y%m%d"`

for index in $INDICES; do
  DATE=`echo $index | perl -ne 'if (m/sessions-(\d+)h\d+/){print "$1\n"}'`
  DIFF=$(($TODAY - $DATE))
  if [ $DIFF -gt $RETAINDAYS ]
  then
    curl -XDELETE $HOST:$PORT/$index
  fi
done