# Marvel duplicate cluster entries

**URL:** <https://discuss.elastic.co/t/marvel-duplicate-cluster-entries/63708>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring\
**Created:** [October 24, 2016, 6:11am UTC](https://discuss.elastic.co/t/marvel-duplicate-cluster-entries/63708 "2016-10-24T06:11:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gpestana](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gpestana/32/12667_2.png) [@gpestana](https://discuss.elastic.co/u/gpestana)\
**Post date:** [October 24, 2016, 6:11am UTC](https://discuss.elastic.co/t/marvel-duplicate-cluster-entries/63708/1 "2016-10-24T06:11:30Z")

</div>

All of a sudden, Marvel started to monitor 2 cluster with the same name. How can I delete the data from one cluster? I think I could use the delete by query, but if the clusters' names are the same (say clusterA), how can I remove all data form the duplicate cluster and keep the original data?

And based on the data in the ES Marvel, there is only one cluster uuid.

**[EDIT]**  
More information about the problem:

- This didn't happen 'all of a sudden', but when the cluster which was being monitored was recreated;
- The old cluster and new one DO have different cluster\_uuid. But there seems to be not data of the old one in the Marvel indices (query "cluster\_uuid:old\_cluster\_uudi" does not return any data) --\> No use to delete by query then.

Now, I believe that there is some sort of metadata about the old cluster laying around, maybe on the .marvel-es-data indice. The question remains the same: how can I delete it?

**[EDIT2]**  
When querying all data from the main Marvel index:

_GET cluster:9200/.marvel-es-data-1/\_search?q=_ \*

hits: [  
{ \_source.cluster\_uuid : "new\_uuid",..},  
{ \_source.cluster\_uuid : "new\_uuid",..}  
{ \_source.cluster\_uuid : "new\_uuid",..}  
..  
]

There is no information about the "old\_uuid" whatsover, so the main (metadata?) Marvel index does not have any pointer to it.

More info:

- Elasticsearch 2.3
- (dedicated) Marvel cluster

---

<div class="post-metadata">

**Author:** ![pickypg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pickypg/32/62409_2.png) [@pickypg](https://discuss.elastic.co/u/pickypg)\
**Post date:** [October 24, 2016, 10:53pm UTC](https://discuss.elastic.co/t/marvel-duplicate-cluster-entries/63708/2 "2016-10-24T22:53:37Z")

</div>

Hi Goncalo,

The `.marvel-es-data-1` index is definitely our metadata index, but you can also glean some extra info by restricting it to the `cluster_info` type.

```auto
GET /.marvel-es-data-1/cluster_info/_search?pretty

```

This will give you only the cluster info documents, which is part of what gets loaded for the cluster listing screen. Beyond that, there's also the time-based index, where we more dynamically load / store the cluster state:

```auto
GET /.marvel-es-1-*/cluster_state/_search?pretty
{
  "size": 0,
  "aggs": {
    "group_by_cluster_uuid": {
      "terms": {
        "field": "source_node.cluster_uuid"
      }
    }
  }
}

```

If it sees more than one Cluster UUID, then it should appear that way. You can then use Delete By Query against the `.marvel-es-1-*` indices to delete whatever you need / want.

Hope that helps,  
Chris

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/marvel-duplicate-cluster-entries/63708/3 "2017-07-06T13:41:48Z")

</div>