How to delete index template for data stream

Elastic Stack Elasticsearch
1

Hi, I have created an index template which creates a data stream for testing purposes and would like to get rid of it.

I cannot delete the index template:

grafik

OK, there is still an exisitng data stream. I cannot delete the data stream, it gets recreated after a few seconds. I made sure the data source has stopped sending data, in fact there are 0 documents in the backing index.

grafik
grafik2554×2322 426 KB

When I try to change the index template, for example by disabling the data stream, or changing the index pattern I get the following error:

grafik
grafik2416×212 40.2 KB

It seems I have created an unsolvable situation. Is there a way to force delete the index template or another solution to get rid of the data stream setup?

As I can only activate or deactivate sending data in the source application (Zenarmor on OPNSense), I am currently unable to collect data.

Thank you!

2

Here is how I solved this, I hope this helps someone in a similar situation:

  1. stop all elasticsearch services
  2. set http.port in /etc/elasticsearch/elasticsearch.yaml to 9201
  3. start only elasticsearch

in the terminal, runn the following commands:
curl -u USERNAME:PASSWORD -X DELETE https://127.0.0.1:9201/_data_stream/zenarmor_0000000000_949c03e0-7f1b-4627-8925-66215cba22fd_conn_write --insecure
curl -u elastic:ywaEZIIr7md4HpOjTsr7 -X DELETE https://127.0.0.1/_index_template/zenarmor_conn --insecure

revert the setting in elasticsearch.yaml
restart all services

done.

1 Like