Already deleted monitor is reporting monitor status to elasticsearch

Elastic Observability Synthetics
1

I deleted a synthetics monitor but still receive new monitor results in the synthetics-* datastream. The monitor is also still visible in the old uptime app and the monitor is triggering alerts that are configured based on monitor tags. I can not delete the monitor via the ui, because its not visible and the synthetics app and I can not delete the monitor via the kibana api.

I am running elastic stack version 8.18.1.

How to get rid of the leftover monitor?

3

Have you tried deleting it directly from the index? If you are not familiar with the terminal, you can do this directly from Kibana via Devtools. First, you apply a GET to check the permanence of the index you want to remove.

First, identify the exact monitor ID with GET


GET /synthetics-*/_search
{
  "query": {
    "term": {
      "monitor.id": "your-monitor-id"
    }
  }
}

Then delete all documents for that monitor

POST /synthetics-*/_delete_by_query
{
  "query": {
    "term": {
      "monitor.id": "your-monitor-id"
    }
  }
}

Or try deleting through the Fleet API:

POST /api/fleet/agent_policies/delete_monitors
{
  "monitorIds": ["your-monitor-id"]
}
4

Deleting the data is not the problem. I need the monitor to stop reporting new data.
The endpoint /api/fleet/agent_policies/delete_monitors does not exist.

5

Sorry for asking again, did you remove the index or remove the policy? Because removing the index will cause it to re-execute, you must remove the policy and restart the agent to unlink the requests.

6

I am using elastic synthetics monitoring and therefore no agents and no agent policies.
The monitor was removed via the synthetics app of kibana.