Old .kibana indexes

Elastic Stack Kibana
1

Hello,

I've noticed we have kibana indexes:
.kibana-event-log-7.10.2-*
.kibana_*
.kibana_task_manager_*

And then since we upgraded to 7.13.1 we also have:
.kibana-event-log-7.13.1-*
.kibana_7.13.1_*
.kibana_task_manager_7.13.1_*

I was wondering if I can delete old .kibana indexes showed at the top?
These are mostly empty, but I can see that for example .kibana-event-log-7.10.2-* are still being created. How can I stop them?

Kind regards,
Dane

2

Hi
Could you share an example of the logs that are created in

.kibana-event-log-7.10.2-*

Are there logs in

.kibana-event-log-7.13.1-*

Are there multiple Kibana instances?

Thx!

3

Hi Matt,

Yes, there are two Kibana instances.

.kibana-event-log-7.10.2-* indexes are empty.
And here is a document from .kibana-event-log-7.13.1-* index:

      {
        "_index" : ".kibana-event-log-7.13.1-000001",
        "_type" : "_doc",
        "_id" : "Y5a49HkBZN82dk1ypBOP",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2021-06-10T07:00:10.578Z",
          "event" : {
            "provider" : "alerting",
            "action" : "execute",
            "start" : "2021-06-10T07:00:10.578Z",
            "outcome" : "success",
            "end" : "2021-06-10T07:00:11.102Z",
            "duration" : 524000000
          },
          "kibana" : {
            "saved_objects" : [
              {
                "rel" : "primary",
                "type" : "alert",
                "id" : "143a10bc-0820-4b65-bfde-ef7499106c5a"
              }
            ],
            "alerting" : {
              "status" : "ok"
            },
            "server_uuid" : "cdbcbb2c-5105-493d-9767-9a8373fd043d"
          },
          "message" : """alert executed: xpack.uptime.alerts.durationAnomaly:143a10bc-0820-4b65-bfde-ef7499106c5a: 'Anomaly detection alert "fw-mh-p-fot-01 "'""",
          "ecs" : {
            "version" : "1.8.0"
          }
        }
      },

Thanks for the help.

Kind regards,
Dane

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.