ELK Delete Indices

Elastic Stack Elasticsearch
1

Hi,

I'm new to ELK stack. Our server is running out of disk space and we have a cronjob running to delete the indices.

1 1 * * * /usr/local/bin/curator /root/.curator/action_remove_old_logs.yml

But what is occupying more on the disk is the data under the path,
/storage/elasticsearch/elasticsearch/nodes/0/indices

where I see many random named folders like below

XY-6RdNjRlKCX8gHxcXAEg
YCUyx5gNTjOzH7bmJwGy3w
ymqMWFmXRxeUmF7sg-ADVw

So what are these and is it safe to remove these folders? Please advice.

Thank You

2

That is the indexed data and you should NEVER delete anything directly from disk there. Instead use the APIs to delete indices you no longer need.

3

Alright. So based on the output I got,

health status             index                       uuid        pri rep docs.count docs.deleted store.size pri.store.size
yellow open   logstash-vshield-2020.01.18 U0-ss6OmT1-PCog7lB5ykQ   5   1   14476719            0      2.8gb     2.8gb

The API to delete the index would be,

curl -XDELETE 'localhost:9200/logstash-vshield-2020.01.18'

So it is safe to run this command ?

Thank You

4

If you are looking to delete that index the command looks fine.

5

Thank You for your quick responses.