Close Elasticsearch indices older than X days

close-indices.py

import requests
import json
import datetime
from requests.auth import HTTPBasicAuth

auth = HTTPBasicAuth('elastic', '')
index_pattern = "winlogbeat-*"
days = 90

response = requests.get(f'https://mtllppsecelk01:9200/{index_pattern}/_settings/index.creation_date_string?flat_settings=true&human&expand_wildcards=open', verify=False, auth=auth)
if response.status_code == 200:
    indices = response.json()
else:
    print(response.__dict__)


def parse_date(date):
    for fmt in ('%Y-%m-%dT%H:%M:%S.%fZ', '%Y-%m-%dT%H:%M:%SZ'):
        try:
            return datetime.datetime.strptime(date, fmt)
        except ValueError:
            pass
    raise ValueError(("no valid date format found"))

old_indices = []
for i in indices:
    date = indices[i]['settings']['index.creation_date_string']
    creation_date = parse_date(date)
    if creation_date < datetime.datetime.now()-datetime.timedelta(days=days):
        response = requests.post(f'https://mtllppsecelk01:9200/{i}/_close', verify=False, auth=auth)
        if response.status_code == 200:
            print(f"Closed index {i}")