# Elasticsearch: How to delete restricted indices

**URL:** <https://discuss.elastic.co/t/elasticsearch-how-to-delete-restricted-indices/378284>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 19, 2025, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-delete-restricted-indices/378284 "2025-05-19T09:26:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cisupport-zkb](https://avatars.discourse-cdn.com/v4/letter/c/5e9695/32.png) [@cisupport-zkb](https://discuss.elastic.co/u/cisupport-zkb)\
**Post date:** [May 19, 2025, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-delete-restricted-indices/378284/1 "2025-05-19T09:26:10Z")

</div>

Hi everyone,

I'm trying to upgrade from Elasticsearch 8.18.0 to 9.0.1, but before upgrading I need to set to read only or delete old created indices with compatibility 7090199, otherwise won't boot up the Elasticsearch service.

I found that these indices `.reporting-2023*` were created with the compatibility 7090199 and I decided to delete it.

Following the API documentation [Elastic Security API | allow\_restricted\_indices](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-bulk-put-role#operation-security-bulk-put-role-body-application-json-roles-indices-allow_restricted_indices) I need to assign to the user this privilege `"allow_restricted_indices": "true"`.

I created an API key inside the Kibana API keys page for the user "elastic". When I go inside "Update API key" it's possible to activate "Control security privileges". Inside this section I inserted following role:

```auto
{
  "allow-restricted-indices-role": {
    "cluster": [
      "all"
    ],
    "indices": [
      {
        "names": [
          ".*",
          "*"
        ],
        "privileges": [
          "read",
          "write",
          "delete",
          "delete_index",
          "manage",
          "all"
        ],
        "allow_restricted_indices": true
      }
    ],
    "applications": [],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
  }
}

```

 ![2025-05-19 11_05_36-API keys - Elastic](https://us1.discourse-cdn.com/elastic/original/3X/5/3/531af8c4d81a4228f7f15a49aa1b636c1a132bda.png)

After updating the API key, I try to delete one `.reporting-2023*` index with curl command using the upon API key but I receive this error:

`{"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:admin/delete] is unauthorized for API key id [<hidden>] of user [elastic] on restricted indices [.reporting-2023<hidden>], this action is granted by the index privileges [delete_index,manage,all]"}],"type":"security_exception","reason":"action [indices:admin/delete] is unauthorized for API key id [<hidden>] of user [elastic] on restricted indices [.reporting-2023<hidden>], this action is granted by the index privileges [delete_index,manage,all]"},"status":403}`

Did I something wrong or I need to create another user with admin / superuser privileges? How can I remove these restricted `.reporting-2023*` indices?

Thanks a lot 🙂

Gabriele

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [May 20, 2025, 6:04am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-delete-restricted-indices/378284/2 "2025-05-20T06:04:07Z")

</div>

Hello ,

Ideally it should be possible. Please find below post related to same :

> [@How to delete system indices?](https://discuss.elastic.co/t/how-to-delete-system-indices/338510):
>
> Hi all, My current cluster is an upgraded cluster from version 7.x to 8.x It has alot of system indices that nolonger require in the cluster but whenever i tried to delete it. I got this message { "error": { "root\_cause": [{ "type": "security\_exception", "reason": "action [indices:admin/delete] is unauthorized for user [elastic] with effective roles [superuser] on restricted indices [.kibana\_8.6.2\_001], this action is granted by the index privileges [delete\_index,…

Please share if you still facing any issue.

Thanks!!

---

<div class="post-metadata">

**Author:** ![cisupport-zkb](https://avatars.discourse-cdn.com/v4/letter/c/5e9695/32.png) [@cisupport-zkb](https://discuss.elastic.co/u/cisupport-zkb)\
**Post date:** [May 20, 2025, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-delete-restricted-indices/378284/3 "2025-05-20T06:33:56Z")

</div>

Hi Tortoise,

Thanks for the Link of the other post!

After many tries it worked to me, by assigning to a created user the `kibana_system` role.

Gabriele