Cannot delete packetbeat index

Elastic Stack Elasticsearch
1

Hi I installed packetbeat because I wanted to check the traffic, now I don't need it anymore. I stopped the packetbeat service, disabled it and then uniinstalled the rpm package. Still there is a packetbeat index in ES but if I try to delete it I get this error:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "index [.ds-packetbeat-9.0.0-2025.05.21-000001] is the write index for data stream [packetbeat-9.0.0] and cannot be deleted"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "index [.ds-packetbeat-9.0.0-2025.05.21-000001] is the write index for data stream [packetbeat-9.0.0] and cannot be deleted"
  },
  "status" : 400
}

how can i delete it?
many thanks

2

Hello @albertino87

As per message this index is the current write index for the datastream so it cannot be deleted.

To delete the index below steps could be considered :


POST /packetbeat-9.0.0/_rollover

DELETE /.ds-packetbeat-9.0.0-2025.05.21-000001

Thanks!!

3

Thank you very much, that worked!

1 Like
4

What you did abovw just created another index... And deleted the old index

You probably just want to delete the entire data stream If you no longer need it

DELETE _data_sream/packetbeat-9.0.0