Can I delete deprecation log indices by a query?

Thank you for always providing useful information.
Several days ago we upgraded Elasticsearch to version 7.17.2 at our data center.
After upgrading we found that cluster health is yellow. Before upgrading it was not
so. We invetigated the cause. We found that replica shars of deprecation log indices
were assined when primary shars were created though our cluster is single.
We set the "number_of_replicas" to "0" in the definition of the template and created
indices and then cluster health became green.
But now the number of deprecation log indices is 11. We confirmed .deprecation-indexing-ilm-policy and the attribute "Maximum age" is 14. If we execute a query to get the count of data in the index, responce will be 0 except for the latest index. The size of shar is default. We want to free tha space not used. Is it okay to drop the deprecation log index whose count of the data is 0 by the query such as "curl -u elastic -XDELETE 'http://localhost:9200/[index_name]'?
Thank you.

I found the solution by myself. I didn't understand ILM. As an index such as .ds-.logs-deprecation.Elasticsearch-default-2022.MM.DD-0000XX
is managed by the policy ".deprecation-indexing-ilm-policy". I confirmed the definition of it. Though the hot phase is specified, the delete
phase is not specified. So I added the delete phase to the policy. After that all indices that had existed over the "min_age" of the delete
phase were deleted without error. Thanks to those who have seen my question.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Welcome to the forum and thanks a lot for the follow-up @fujita and sharing the solution you found with others! :slight_smile:

This post was made in the Spanish speaking part of the forum and hence was not seen by as many people over here.