Is there a way to clean .kibana* indices? I got 22 of them!

Elastic Stack Kibana
1

I'm running a cluster on Elastic Cloud, in which I have 3 index.

But my cluster is also filled with plenty of "system indices" I never really wanted:

.kibana-event-log-7.15.2-000001 
.kibana_task_manager_7.15.2_001
.security-tokens-7   
.apm-custom-link
.kibana_7.15.2_001
.kibana-event-log-7.13.0-000007
.kibana_task_manager_7.13.1_001
.kibana-event-log-7.13.0-000005
.kibana-event-log-7.13.0-000006
.kibana-event-log-7.13.1-000006
.kibana-event-log-7.13.1-000005
.kibana-event-log-7.13.0-000004
.kibana-event-log-7.13.1-000004
.fleet-enrollment-api-keys-7
.kibana-event-log-7.13.1-000003
.apm-agent-configuration
.kibana_7.13.0_001
.tasks
.security-7
.kibana_task_manager_7.13.0_001
.kibana_7.13.1_001
.fleet-policies-7

I don't have Fleet, I don't have APM, and most of these indices are empty. But still they all assign shards and consume CPU/RAM.

As we are not supposed to delete system indices, my question are:

  • can we have a description on each system index? Like in the "_meta" field that would be awesome;
  • is there a way to clean things up? I only need the .kibana index in my opinion;
  • should I stop upgrading versions to avoid new system indices :grimacing:

Thanks!

Related to Kibana system indices

EDIT : I see there is a plan to "hide" thoses indices: https://github.com/elastic/elasticsearch/issues/50251 but still, I feel like there is too much indices here.

1 Like
2

Why do you want to remove these indices? Do you believe them to be causing you performance issues? Or is it the "clutter" in e.g. lists of indices on system that concerns you?

3

We have spent a long time telling users to reduce shard count, yet there's all these system ones with nothing in then, with no use, that we're auto-creating. I think this is a reasonable basis for wanting these removed.

2 Likes
4

I had many of this since 7.2 and all the upgrade till 7.15.1 that I apply.

just nuke them. it does not used if you do not have any of that version install. I remove all them last week.

make sure you don't delete latest one or you are doomed.
Also do not remove .kibana, .security, .tasks etc... which are alias

you can check by just printing all aliases

GET /_cat/aliases?v

1 Like
5

Like @warkolm said, yes it feels like my cluster is dirty: lots of indices / shards with no use.

I'm indeed worried about performance and resources wasted (RAM, file descriptor, CPU...).

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.