Elasticsearch index

Elastic Stack Elasticsearch
1

I have to remove old data of apiman-indices in Elasticsearch which contain .pos, .cf or any other extension. So how can we remove the old indices?

2

Do you mean you have to remove the documents (events) in you indices with this information?

If so, is this stored in a specific field or part of a field?

3

yes how can i remove this

4

You should be able to do this with a delete_by_query

Could you perhaps share an example doc?

5

There are many ways to do it:

  1. if you know the doc id which needs to be removed use:
    DELETE /<index>/_doc/<_id>

  2. if you have many docs to be remove then use ( which can be identified via a query) then use :

POST /my-index-000001/_delete_by_query
{
  "query": {
    "match": {
      "user.id": "elkbee"
    }
  }
}
  1. if you want to delete the index itself then use :
    DELETE /<index>

yiu can use all these apis in kibana interface .

1 Like
6

NO no, Actually i want to remove APIMAN-METRICS in Elasticsearch which is very old and consume lot of spaces. data stored in APIMAN-METRICS is .cfs, .pos this type of form so how can i delete this type of data. it directly not shown in JSON format. How can i delete this?

7

It's confusing. Isn't APIMAN-METRICS is a field of some index in your elasticsearch cluster? Why it is not shown and if it is not shown, how to specify the documents??

8

@umangpatel

Please run these in Kibana Dev Tools and share the output

GET /

GET _cat/indices?v

Then perhaps we can help.

9

Sorry, but We have using oldest version of kibana. And i can't see kibana dev tools in kibana dashboards. what's next step?

10

What version of Elasticsearch are you running?

The equivalent commands can be run using curl fro

curl http://<elasticsearch hostname>:9200/

etc that should show the version.

curl http://<elasticsearch hostname>:9200/_cat/indices/?v

11

We have using ES version 1.7.2

12

That is incredibly old and EOL and assuming there's any data of value in there, you should seriously consider upgrading.

Those commands should still work.

Run the _cat indices and show us what the result is.

13

Pl find screenshot. Result of above command
indices

14

A) Do want to completely remove the entire apiman index, completely remove it?

B) Or just certain documents from inside the apiman index an leave the rest of the documents?

15

No no, I want to remove just 6 months old documents inside apiman index. Not remove entire apiman index.

16

Any Update on this..

17

You will need to get the index back to green then use delete_by_query as suggested above... Only way to do what you want.

18

How to get the index back to green?

19

Good question...

Run

This

And this

And show The full output in text not a screenshot and perhaps we can help.

20

OK, I will check and send a results to you