# Can I delete monitoring and logging indexes?

**URL:** <https://discuss.elastic.co/t/can-i-delete-monitoring-and-logging-indexes/238165>\
**Category:** Elastic Search\
**Tags:** elastic-app-search\
**Created:** [June 23, 2020, 12:48am UTC](https://discuss.elastic.co/t/can-i-delete-monitoring-and-logging-indexes/238165 "2020-06-23T00:48:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gpribi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gpribi/32/65066_2.png) [@gpribi](https://discuss.elastic.co/u/gpribi)\
**Post date:** [June 23, 2020, 12:48am UTC](https://discuss.elastic.co/t/can-i-delete-monitoring-and-logging-indexes/238165/1 "2020-06-23T00:48:11Z")

</div>

As I mentioned in my previous post ([AppSearch disk consumption keeps growing](https://discuss.elastic.co/t/appsearch-disk-consumption-keeps-growing/236101)), my EES+ES node is quickly filling up the disk, even my document count and size is pretty stable

Kibana shows me that my most heavy indexes are  
.monitoring-es-7-2020-XX-XX : 700MB each.  
.ent-search-api-ecs-logs-togo\_production-7.6.0-2020-XX-XX: also 700MB each  
.ent-search-app-search-analytics-ecs-logs-togo\_production-7.6.0-2020-XX-XX: 200MB each

I don't use any of the analytics features in appsearch.  
Can I delete or make some operation in order to reduce their size?  
In my last post my HD was 12GB, now it's 50GB!

---

<div class="post-metadata">

**Author:** ![defalt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defalt/32/71379_2.png) [@defalt](https://discuss.elastic.co/u/defalt)\
**Post date:** [July 8, 2020, 12:37pm UTC](https://discuss.elastic.co/t/can-i-delete-monitoring-and-logging-indexes/238165/2 "2020-07-08T12:37:31Z")

</div>

You can disable montioring: [https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-settings.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-settings.html) and delte that index. But actually the index should delete itself automatically after 7 days.

---

<div class="post-metadata">

**Author:** ![gpribi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gpribi/32/65066_2.png) [@gpribi](https://discuss.elastic.co/u/gpribi)\
**Post date:** [July 8, 2020, 5:59pm UTC](https://discuss.elastic.co/t/can-i-delete-monitoring-and-logging-indexes/238165/3 "2020-07-08T17:59:40Z")

</div>

Thank you @defalt  
That setting affects only the monitoring indexes, which indeed have a retention of 7 days. However, it doesn't affect all the ent-search-\* indexes, which are never deleted

---

<div class="post-metadata">

**Author:** ![JasonStoltz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasonstoltz/32/49893_2.png) [@JasonStoltz](https://discuss.elastic.co/u/JasonStoltz)\
**Post date:** [July 9, 2020, 12:34pm UTC](https://discuss.elastic.co/t/can-i-delete-monitoring-and-logging-indexes/238165/4 "2020-07-09T12:34:10Z")

</div>

Hey @gpribi,

In general, our current recommendation is to use [https://github.com/elastic/curator](https://github.com/elastic/curator) to deal with these large indexes.

Jason

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2020, 12:34pm UTC](https://discuss.elastic.co/t/can-i-delete-monitoring-and-logging-indexes/238165/5 "2020-08-06T12:34:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.