Can I delete empty system indices?

Hi all,

as we have reached the shard limit of 1000 shards per node, we want to clean up some unnecessary indices in our cluster.

We have noticed that there are quite a lot of system indices that are actually fully empty. They seem to belong to components or features that we do not even use, but do an automatic rollover every 30 days no matter what size it has. Hence we got quite a few empty indices.

So my idea was to

  1. change the ILM policy to rollover dependent on size (e.g. 25 GB) and not on time
  2. delete existing empty indices

Do you have any concerns regarding this procedure? For 2) I would take care to definitely only delete indices that have zero docs inside and to always keep at least the newest index, so potential system queries won't fail.

Thank you and best regards
Bianca