# How to delete index template for data stream

**URL:** <https://discuss.elastic.co/t/how-to-delete-index-template-for-data-stream/363505>\
**Category:** Elasticsearch\
**Created:** [July 21, 2024, 7:39pm UTC](https://discuss.elastic.co/t/how-to-delete-index-template-for-data-stream/363505 "2024-07-21T19:39:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andre22](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@andre22](https://discuss.elastic.co/u/andre22)\
**Post date:** [July 21, 2024, 7:39pm UTC](https://discuss.elastic.co/t/how-to-delete-index-template-for-data-stream/363505/1 "2024-07-21T19:39:43Z")

</div>

Hi, I have created an index template which creates a data stream for testing purposes and would like to get rid of it.

I cannot delete the index template:

![grafik](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba94998578435a382789ab762eb68bcbe40f9487.png)

OK, there is still an exisitng data stream. I cannot delete the data stream, it gets recreated after a few seconds. I made sure the data source has stopped sending data, in fact there are 0 documents in the backing index.

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4cf841e0a9b8da16fea18c0e9d9a15b0d85a5983.png)

When I try to change the index template, for example by disabling the data stream, or changing the index pattern I get the following error:

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5c286184514a077860bfe255b7c979f402a8b530.png)

It seems I have created an unsolvable situation. Is there a way to force delete the index template or another solution to get rid of the data stream setup?

As I can only activate or deactivate sending data in the source application (Zenarmor on OPNSense), I am currently unable to collect data.

Thank you!

---

<div class="post-metadata">

**Author:** ![andre22](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@andre22](https://discuss.elastic.co/u/andre22)\
**Post date:** [July 23, 2024, 9:47am UTC](https://discuss.elastic.co/t/how-to-delete-index-template-for-data-stream/363505/2 "2024-07-23T09:47:58Z")

</div>

Here is how I solved this, I hope this helps someone in a similar situation:

1. stop all elasticsearch services
2. set http.port in /etc/elasticsearch/elasticsearch.yaml to 9201
3. start only elasticsearch

in the terminal, runn the following commands:  
`curl -u USERNAME:PASSWORD -X DELETE https://127.0.0.1:9201/_data_stream/zenarmor_0000000000_949c03e0-7f1b-4627-8925-66215cba22fd_conn_write --insecure`  
`curl -u elastic:ywaEZIIr7md4HpOjTsr7 -X DELETE https://127.0.0.1/_index_template/zenarmor_conn --insecure`

revert the setting in elasticsearch.yaml  
restart all services

done.

---

<div class="post-metadata">

**Author:** ![Nerze](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerze/32/142595_2.png) [@Nerze](https://discuss.elastic.co/u/Nerze)\
**Post date:** [April 12, 2025, 8:17pm UTC](https://discuss.elastic.co/t/how-to-delete-index-template-for-data-stream/363505/4 "2025-04-12T20:17:20Z")

</div>

Thank you for the solution. Just in case this is still in production, please change your password, as you leaked it in your second command.