# Indexes created automatically by the system

**URL:** https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125
**Category:** Elasticsearch
**Created:** [October 20, 2022, 2:29pm UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125 "2022-10-20T14:29:44Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![dpelaezb](https://avatars.discourse-cdn.com/v4/letter/d/e9c0ed/32.png) [@dpelaezb](https://discuss.elastic.co/u/dpelaezb)
#### Post date: [October 20, 2022, 2:29pm UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125/1 "2022-10-20T14:29:44Z")

</div>

Hello everyone,

We have an infrastructure that consists of several Filebeats that send the traces to a Logstash located on another machine where there is also a Metricbeat to plot Logstash.

We have detected that a series of indices have been generated automatically and for which we have not been able to find information, can you please tell us what information is stored in these indexes and if is it possible to remove them without causing errors?

- .internal.alerts-observability.logs.alerts-default-
- .metrics-endpoint.metadata\_united\_default
- .reporting-
- .slm-history--
- .transform-internal-
- .transform-notifications-
- ilm-history--
- logs-index\_pattern\_placeholder
- metrics-endpoint.metadata\_current\_default
- metrics-index\_pattern\_placeholder

If you need any additional clarification or more information please let me know.

Regards, and thank you very much,  
David

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 23, 2022, 11:25pm UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125/2 "2022-10-23T23:25:43Z")

</div>

Welcome to our community! 😃

> [@dpelaezb](#):
>
> - .internal.alerts-observability.logs.alerts-default-
> - .metrics-endpoint.metadata\_united\_default
> - .reporting-
> - .slm-history--
> - .transform-internal-
> - .transform-notifications-

These are system created and managed ones, so I wouldn't worry about them at all.

> [@dpelaezb](#):
>
> - ilm-history--
> - logs-index\_pattern\_placeholder
> - metrics-endpoint.metadata\_current\_default
> - metrics-index\_pattern\_placeholder

Can you clarify what version of the stack you are running, it should help understand these a bit better.

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 23, 2022, 11:43pm UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125/3 "2022-10-23T23:43:16Z")

</div>

> [@warkolm](#):
>
> These are system created and managed ones, so I wouldn't worry about them at all.

I think that the main issue is that there is not much information about those system indices, what they are used for and if they can be removed without any risk of breaking something.

I made a [similar question](https://discuss.elastic.co/t/what-are-ilm-history-and-slm-history-indices-used-for/305711) a couple of months ago about the `slm-history` and `ilm-history`, but got no answer.

One of most repeated recomendations from Elastic is to avoid to have lot of small indices and yet Elasticsearch itself keeps creating those small indices without any explanation if it is safe to remove or not.

It would be nice to have some information in the documentation of what is safe to remove or not depending on which features you use.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 23, 2022, 11:47pm UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125/4 "2022-10-23T23:47:21Z")

</div>

I agree, my suggestion there would be to raise something in GitHub so that it can be referred to from here, as it carries more weight.

---

<div class="post-metadata">

### Author: ![dpelaezb](https://avatars.discourse-cdn.com/v4/letter/d/e9c0ed/32.png) [@dpelaezb](https://discuss.elastic.co/u/dpelaezb)
#### Post date: [October 24, 2022, 7:47am UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125/5 "2022-10-24T07:47:40Z")

</div>

Thanks for the welcome and for the answers 🙂

> Can you clarify what version of the stack you are running, it should help understand these a bit better.

I leave the versions of the infrastructure used to clarify the scenario:

- Filebeat: 7.17.0

- Logstash: 7.17.3

- Metricbeat: 7.17.0

- Elasticsearch deployment: 7.17.1

> I think that the main issue is that there is not much information about those system indices, what they are used for and if they can be removed without any risk of breaking something.

The problem with these indices is that by not being able to determine their use and, if possible, their elimination, they grow uncontrollably and a corresponding lifetime cannot be established.

This causes the use of resources and shards to multiply and lead to performance errors.

I appreciate any possible help.

All the best,  
David

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 21, 2022, 7:48am UTC](https://discuss.elastic.co/t/indexes-created-automatically-by-the-system/317125/6 "2022-11-21T07:48:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
