# Cannot delete packetbeat index

**URL:** <https://discuss.elastic.co/t/cannot-delete-packetbeat-index/378629>\
**Category:** Elasticsearch\
**Created:** [May 28, 2025, 7:57am UTC](https://discuss.elastic.co/t/cannot-delete-packetbeat-index/378629 "2025-05-28T07:57:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![albertino87](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albertino87/32/137334_2.png) [@albertino87](https://discuss.elastic.co/u/albertino87)\
**Post date:** [May 28, 2025, 7:57am UTC](https://discuss.elastic.co/t/cannot-delete-packetbeat-index/378629/1 "2025-05-28T07:57:08Z")

</div>

Hi I installed packetbeat because I wanted to check the traffic, now I don't need it anymore. I stopped the packetbeat service, disabled it and then uniinstalled the rpm package. Still there is a packetbeat index in ES but if I try to delete it I get this error:

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "index [.ds-packetbeat-9.0.0-2025.05.21-000001] is the write index for data stream [packetbeat-9.0.0] and cannot be deleted"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "index [.ds-packetbeat-9.0.0-2025.05.21-000001] is the write index for data stream [packetbeat-9.0.0] and cannot be deleted"
  },
  "status" : 400
}

```

how can i delete it?  
many thanks

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [May 28, 2025, 8:58am UTC](https://discuss.elastic.co/t/cannot-delete-packetbeat-index/378629/2 "2025-05-28T08:58:06Z")

</div>

Hello @albertino87

As per message this index is the current write index for the datastream so it cannot be deleted.

To delete the index below steps could be considered :

```auto

POST /packetbeat-9.0.0/_rollover

DELETE /.ds-packetbeat-9.0.0-2025.05.21-000001

```

Thanks!!

---

<div class="post-metadata">

**Author:** ![albertino87](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albertino87/32/137334_2.png) [@albertino87](https://discuss.elastic.co/u/albertino87)\
**Post date:** [May 28, 2025, 11:12am UTC](https://discuss.elastic.co/t/cannot-delete-packetbeat-index/378629/3 "2025-05-28T11:12:42Z")

</div>

Thank you very much, that worked!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 28, 2025, 1:53pm UTC](https://discuss.elastic.co/t/cannot-delete-packetbeat-index/378629/4 "2025-05-28T13:53:47Z")

</div>

What you did abovw just created another index... And deleted the old index

You probably just want to delete the entire data stream If you no longer need it

`DELETE _data_sream/packetbeat-9.0.0`