Delete Indices/index/documents but 404 NotFound

Elastic Stack Elasticsearch
1

Hey,
I want delete all indices, document, but want keep Template index.
i have already try many operations see here in forum, but nothing clean my path data.

A) _settings with index.blocks.read_only_allow_delete and index.blocks.read_only for all _index
OK
B) _bulk?pretty with { "delete" : { "_index" : ".ds-xxxx-filebeat-8.4.2-2023.03.08-2024.01.16-000001", "_id" : "a6ePqeckT0mnCacor_SGOg" } }
i receive status 404 not found.

my folder data is allways 225Giga on two nodes... why ?

thanks.
Good day

2

Normally you should use: Delete index API | Elasticsearch Guide [8.11] | Elastic

What is the output of:

GET /
GET /_cat/indices?v
3

Hi,

To delete all indices, you can use the following command:

DELETE /_all

Regards

4

But note that:

By default, this parameter does not support wildcards (* ) or _all . To use wildcards or _all , set the action.destructive_requires_name cluster setting to false .

1 Like
5

OK, I did it in two steps in CURL:
the first for each clue that I wanted to erase:

_settings?pretty
-H 'Content-Type: application/json' -d'
{ "index.blocks.read_only_allow_delete": null, "index.blocks.read_only": false }
'

the second for each clue that I wanted to erase:

_delete_by_query -H 'Content-Type: application/json' -d'{ "query": { "match_all": {} }}'

result: the deletion is successful, I have my /data directory which has decreased.
I come back to kibana, and I see an old index coming back that I had deleted... am I missing something?

6

OMG! You deleted the documents not the index.
It's better to delete the index.

What do you mean?

The index still exists indeed. But you should probably not see any content anymore.

7

i use streamData, when i go kibana [Index Management] -> Indices
or [Index Management] -> Data Streams
Delete all i want, but... back after some secondes....

8

i want delete the data Stream [March 30th, 2023 3:14:03 PM ] but is back after ....

9

my ILM policy for this data stream normaly is deleted after 24 Days.
why i have 2023 30th March or other ?

10

Hi,

but you can't simple delete this datastream from Kibana gui?

Regards

11

thanks you, lol i do that until yesterday...

12

i try now to see on filebeat, perhaps it cosume old file log.

13

It probably means that you did not stop the tools which are sending data to Elasticsearch, like filebeat, elastic agent....

14

i have put :
ignore_older: 48h

on file filebeat input.

15

But did you stop filebeat?

I mean that first stop filebeat. If no data is coming again, then the problem is solved.

If you have a problem with filebeat configuration, I'd suggest to open a new discussion in Beats with the filebeat tag.

16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.