# Quick question(s) delete test data? **URL:** \ **Category:** Elasticsearch\ **Created:** [June 27, 2018, 3:47pm UTC](https://discuss.elastic.co/t/quick-question-s-delete-test-data/137658 "2018-06-27T15:47:36Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [June 27, 2018, 3:47pm UTC](https://discuss.elastic.co/t/quick-question-s-delete-test-data/137658/1 "2018-06-27T15:47:36Z")
Hi There, I have an elasticsearch server which has had data shipped to it by logstash. This data is just a dump of a servers windows logs. I've been using it to test the basic setup of ELK. Now I'd like to move to something closer to production. I'd like to stop shipping my windows logs (which is fine I know to edit the WinLogBeat config). Delete data in my ES index (and any data on disk) and populate it with the my new data. I understand that I'll need to stop ElasticSearch first. Is the command just DELETE Logstash-\* ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 27, 2018, 5:23pm UTC](https://discuss.elastic.co/t/quick-question-s-delete-test-data/137658/2 "2018-06-27T17:23:06Z")
Don't stop elasticsearch and just run the command you mentioned in Kibana dev console. ---
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [June 28, 2018, 8:20am UTC](https://discuss.elastic.co/t/quick-question-s-delete-test-data/137658/3 "2018-06-28T08:20:20Z")
Will this also clear any locally saved data? I need to look into pushing this onto another partition when we move into production but that's perhaps another discussion. ---
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [June 28, 2018, 3:09pm UTC](https://discuss.elastic.co/t/quick-question-s-delete-test-data/137658/4 "2018-06-28T15:09:33Z")
Hi Everyone, I've deleted my index (It was WinLogbeat not Logstash per previous reply) and now I am really stuck. What I want to do is send the contents of the the windows log "ForwardedEvents" to Logstash -\> Elasticsearch. But I can't seem to recreate the index. When I launch Kibana it says I have to set up the index again (as though it's a 1st time install) I've tried typing winlogbeat-\* and logstash-\* but the "Next" button is greyed out and it's not picking up data. All that's changed: On Kibana in the console typed delete winlogbeat-\* On winlogbeat. Stop service. Comment out default windows logs. Add line -name: ForwardedEvents Restart Winglobeat. But nothing has happened. Aside from the delete and modification of the winlogbeat.yml nothing has changed. ---
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [June 28, 2018, 3:45pm UTC](https://discuss.elastic.co/t/quick-question-s-delete-test-data/137658/5 "2018-06-28T15:45:54Z")
![Capture](https://us1.discourse-cdn.com/elastic/original/3X/d/f/df45bf1b07dfc65da111496987b484bfefa4fad5.JPG) Here's an image. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2018, 3:45pm UTC](https://discuss.elastic.co/t/quick-question-s-delete-test-data/137658/6 "2018-07-26T15:45:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.