Kibana 4 and KOPF showing deleted documents deleted from Elasticsearch

Elastic Stack Kibana
1

I am facing the same issue. I deleted some documents from elasticsearch indices for specific type, using the
curl -XDELETE http://localhost:9200/logstash*/xyztype

When I query the elasticsearch for the same type it doesnt return any result. The message is:

{
"took" : 166,
"timed_out" : false,
"_shards" : {
"total" : 1035,
"successful" : 1035,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : null,
"hits" : [
]
}
}

But when browsing results in Kibana Discover screen and visualizing by types, that type is still there with many records of that type. I have no idea on whats going on. Also the KOPF plugin is also showing the same count of records that Kibana Discover interface is showing without any filters.

What is wrong is it Elasticsearch or Kibana.? Pls help

2

Any guidance on this? I am still seeing results in Kibana visualization in the bar chart for the type that should not be there as I have deleted that type in elasticsearch.

3

I tried doing a bit more research and tried running the query suggested here Clear deleted docs.
$ curl -XPOST 'http://localhost:9200/twitter/_optimize?max_num_segments=1'

This made all the size of my indexes less over 80 MB but the number of documents shown are still the same in KOPF interface.

4

Have you refreshed your mappings in Kibana?

5

Yes, I have done the refresh several times from the Kibana Settings and selecting logstash-* index.

6

Could you post some screenshots of what you see in Kibana?

7

The column marked with arrow should not be there. It has more than 600000 records, which I deleted from elasticsearch.

Also the document count marked with arrow should be less by the same number as shown in Kibana column chart for that _type. The total count should be around 1316384-600000

8

Great, and just for completeness, which versions of Kibana and ES are you running?

9

Running Kibana 4.1.2 and ES 1.5.2

10

Deleting an index in not an option as these indexes are already in production and conatain many _types of records, only can delete a _type in the indexes

11

Any advice on this? Bump