Kibana system indices

[congwensheng]

the elasticsearch version is 7.9.2
i found there are some system indices
.kibana-event-log-7.9.2-000001
.kibana_task_manager_1
.monitoring-kibana-7-2020.10.28
.kibana_2
.kibana_1
I can't figure out how these indexes come from，can i delete them.Which configuration should I modify in the kibana.yaml in order to delete them?why there are two system indices named .kibana_1 and .kibana_2,What is their role

[bhavyarm]

Hello,

These are internal kibana indices and it is not advisable to delete them. They are used by Kibana to make sure various applications work fine.

.kibana_1 and .kibana_2 are created during saved object migration. Did you upgrade from a previous version? In which case - .kibana_2 would be an alias to .kibana_1 and was created to make sure migration(upgrade) went through fine.

cc @LeeDr

Thanks,
Bhavya

[rashmi (kulkarni)]

@congwensheng

.kibana_2
.kibana_1

Is this a fresh install ?

Those .kibana_<id> indexes are due to upgrades if you have done one. The index to which the .kibana alias points to is the current index. All the other ones can be safely deleted (except .kibana_task_manager of course) unless you might downgrade to a previous version.

If you want to back up your kibana data, you can simply snapshot and restore the .kibana indices.

If you want to know exactly why Kibana does this and how it does it, you can read this troubleshooting guide.

The bottom line is that you should not delete the .kibana alias and let Kibana do its job, because you will certainly undergo another migration when you upgrade to the next version.

Thanks
Rashmi

[borg]

But I just restart Kibana and multiple indexes appear.Sometimes it goes to .kibana_4
I wonder if this situation has something to do with the stability of ElasticSearch
If there is a timeout, this will happen