# Logstash recreating deleted Index in ES

**URL:** <https://discuss.elastic.co/t/logstash-recreating-deleted-index-in-es/118453>\
**Category:** Logstash\
**Created:** [February 5, 2018, 1:01pm UTC](https://discuss.elastic.co/t/logstash-recreating-deleted-index-in-es/118453 "2018-02-05T13:01:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manasa](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@Manasa](https://discuss.elastic.co/u/Manasa)\
**Post date:** [February 5, 2018, 1:01pm UTC](https://discuss.elastic.co/t/logstash-recreating-deleted-index-in-es/118453/1 "2018-02-05T13:01:45Z")

</div>

I am pushing logstash output to ES and creating indices based on date and doc.  
I tried deleting one of today's index from ES using XDELETE and it got deleted. But it is getting recreated and all of today's data is also getting loaded.

I was expecting it to stream only the logs created after the deletion of index.

Am I missing something here? Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 5, 2018, 1:49pm UTC](https://discuss.elastic.co/t/logstash-recreating-deleted-index-in-es/118453/2 "2018-02-05T13:49:49Z")

</div>

What does your Logstash configuration look like?

---

<div class="post-metadata">

**Author:** ![Manasa](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@Manasa](https://discuss.elastic.co/u/Manasa)\
**Post date:** [February 6, 2018, 10:12am UTC](https://discuss.elastic.co/t/logstash-recreating-deleted-index-in-es/118453/3 "2018-02-06T10:12:24Z")

</div>

The issue got resolved. Logstash was trying to process grok on a log entry which was pretty big and the CPU usage was also very high.

Once we removed that log line, everything started working fine. The deleted indices are not getting recreated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 10:12am UTC](https://discuss.elastic.co/t/logstash-recreating-deleted-index-in-es/118453/4 "2018-03-06T10:12:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.