How to Disable Default Index Creation in ELK and Kibana to Save Storage Space

Elastic Stack Elasticsearch
1

Hi ELK Community,

I'm currently facing a significant storage issue due to the default indices created by ELK and Kibana. My environment has over 40 indices,
These indices are consuming a considerable amount of storage space. I would like to disable the creation of these default indices to optimize storage usage. Could anyone guide me on how to disable or manage the default indices effectively?

Your assistance will be greatly appreciated
ELK-version: 8.13

2

Hello and welcome,

Please share some evidence of the indices you are talking about, it is not clear what you are referring when you say default indices.

Get a screenshot from Kibana or run the following requests in Kibana Dev Tools and share the result indicating which are the indices.

GET _cat/indices

Also, the indices that elasticsearch created automatically are used internally by multiple features and are required.

3

In elk.conf I have added * * action.auto_create_index: false
but it's not reflecting

.apm-agent-configuration
.apm-custom-link
.apm-source-map
.ds-.kibana-event-log-ds-2024.09.02-000014
.ds-.kibana-event-log-ds-2024.09.11-000020
.ds-.logs-deprecation.elasticsearch-default-2024.07.19-000004
.ds-.logs-deprecation.elasticsearch-default-2024.08.18-000005
.ds-.logs-deprecation.elasticsearch-default-2024.09.17-000007
.ds-filebeat-8.12.2-2024.03.19-000001
.ds-ilm-history-5-2024.05.11-000003
.ds-ilm-history-7-2024.08.23-000013
.ds-logs-generic-default-2024.04.25-000002
.ds-metricbeat-8.12.0-2024.04.11-000002
.ds-metricbeat-8.12.2-2024.04.17-000002
.internal.alerts-default.alerts-default-000001
.internal.alerts-ml.anomaly-detection-health.alerts-default-000001
.internal.alerts-ml.anomaly-detection.alerts-default-000001
.internal.alerts-observability.apm.alerts-default-000001
.internal.alerts-observability.logs.alerts-default-000001
.internal.alerts-observability.metrics.alerts-default-000001
.internal.alerts-observability.slo.alerts-default-000001
.internal.alerts-observability.threshold.alerts-default-000001
.internal.alerts-observability.uptime.alerts-default-000001
.internal.alerts-security.alerts-default-000001
.internal.alerts-stack.alerts-default-000001
.internal.alerts-transform.health.alerts-default-000001
.kibana-observability-ai-assistant-conversations-000001
.kibana-observability-ai-assistant-kb-000001
.kibana_8.15.0_001
.kibana_alerting_cases_8.12.2_001
.kibana_alerting_cases_8.15.0_001
.kibana_analytics_8.15.0_001
.kibana_ingest_8.15.0_001
.kibana_security_solution_8.15.0_001
.kibana_task_manager_8.15.0_001
.slo-observability.sli-v3.3
.slo-observability.summary-v3.3
.slo-observability.summary-v3.3.temp
.tasks
kibana-observability-ai-assistant-conversations-000001
4

What is the size of these indices? I would expect most of them to be rather small.