Kibana Still Displays Data From Uninstalled Filebeat

[peter.alfafara]

Hi,

We are currently experiencing an issue where Kibana still displays data gathered by our uninstalled Filebeat.

We initially installed Filebeat along with ElasticSearch, Kibana and Logstash. Then we decided to use Sensu as our metrics collection engine instead of Filebeat. So we uninstalled all these softwares and then we just reinstalled ElasticSearch, Kibana and Logstash. But upon configuring these 3 tools, the data gathered by the previously configured filebeat's is still displaying in Kibana.

We have used the following command to uninstall filebeat:
sudo apt-get --purge autoremove filebeat

And deleted the following directories manually:
/etc/filebeat
/var/lib/filebeat
/var/log/filebeat

Also, we are unable to delete the index of filebeat in elasticsearch.

Anything else we might have missed? Thank you.

Regards,
Peter

[shaunak (Shaunak Kashyap)]

This sounds like more of a Filebeat question so I'm moving it to that category. If this turns out to be a Kibana issue, please move it back to the Kibana category.

[ruflin]

Uninstalling filebeat does not mean the data is removed from elasticsearch. Can you share some details on why you were not able to remove the filebeat indices?

[andrewkroh]

Probably when reinstalling Elasticsearch you didn't remove the data directory so the data is still present. You can drop the indices and template with:

curl -XDELETE http://localhost:9200/filebeat-*
curl -XDELETE http://localhost:9200/_template/filebeat