How to delete old system indices?

Elastic Stack Elasticsearch
1

I have a bunch of old indices from old versions I’d like to get rid of to free up disk and shards, e.g.:

  • .kibana_task_manager_7.15.2_001
  • .kibana_task_manager_7.17.5_001
  • .kibana_task_manager_8.3.3_001
  • .kibana_task_manager_8.6.0_001
  • .kibana_7.15.2_001
  • .kibana_7.17.5_001
  • .kibana_8.3.3_00
  • .kibana_8.6.0_001
  • .kibana_8.11.1_001

As an admin with superuser privileges, I still can’t delete them though:

action [indices:admin/delete] is unauthorized for user [*****] with effective roles [superuser] on restricted indices [.kibana_task_manager_8.3.3_001,.kibana_7.17.5_001,.kibana_8.6.0_001,.kibana_task_manager_7.17.5_001,.kibana_task_manager_8.6.0_001,.kibana_7.15.2_001,.kibana_8.11.1_001,.kibana_task_manager_7.15.2_001,.kibana_8.3.3_001], this action is granted by the index privileges [delete_index,manage,all]

These aren’t being used by anything (I’ve checked the aliases), so how do I clear them out?

2

Hi @garethhumphriesgkc ,

I understand you are trying to delete Kibana indices from older versions. Do make sure that none of these indices are in use, otherwise Kibana will stop working. These indices are created as part of the saved objects migration and Kibana may be reusing “older” indices if there were no changes of mappings between versions.

If you have checked the list of aliases/indices and confirmed that these indices are not in use, then you can proceed to delete them. In order to do so, you will need to create a temporary role/user that has access to the Kibana system indices:

  • Create role:
PUT _security/role/grant_kibana_system_indices
{
  "indices": [
    {
      "names": [
        ".kibana*"
      ],
      "privileges": [
        "all"
      ],
      "allow_restricted_indices": true
    }
  ]
}
  • Create temporary user and assign the above role (feel free to change the password value):
POST /_security/user/temporarykibanasuperuser
{
  "password" : "l0ng-r4nd0m-p@ssw0rd",
  "roles" : [ "superuser", "grant_kibana_system_indices" ]
}

You can then use this temporary user to delete the respective Kibana indices.

Delete this temporary role/user once you are done:

DELETE _security/user/temporarykibanasuperuser
DELETE _security/role/grant_kibana_system_indices
1 Like
3

Thanks.

I’ve just added:

{
  "names": [
    "*",
    ".*"
  ],
  "privileges": [
    "all"
  ],
  "allow_restricted_indices": true
}

to our standard admin role.