Remove 7.x indices after upgrade to 8.x

[chouben (Christof H)]

Hi

I was wondering if we could remove the old 7.x indices from our Elastic Stack, since we upgraded to 8.x?

E.g. Kibana:

Remark: I found out about the allow_restricted_indices setting, which would probably allow me to manage them

Heartbeat, Filebeat & Metricbeat have ILM, which makes them disappear finally. Same for our (old) APM server.

I also found some other indices which seem to point to 7.x versions:

Thanks!
Christof

[chouben (Christof H)]

Just set up a new env 8.7.1 via blog tutorial.

It seems at least .security-7 is still used in 8.x versions:

We currently have 935 indices, so I'm also revising the index strategy beside cleanup.
Anyone who can indicate with certainty which indices can be removed after an 7.17 to 8.x upgrade (we run currently 8.9)?

[chouben (Christof H)]

No one?

[dadoonet (David Pilato)]

I believe you can start by removing everything which is like *-7.*.*-* but please check what are those indices first.
I don't have a better answer yet.

Indices which don't have an exact version number in it should be kept as is IMO.

[chouben (Christof H)]

I'm afraid that might be risky. As indicated in my second post, I see that some indices with the "*-7.*.*-*" indication are still used:

.security-7 is still used in 8.x versions

Based on you feedback, I assume it is best to not touch those indices..

[dadoonet (David Pilato)]

But .security-7 should not match *-7.*.*-*, right?

[chouben (Christof H)]

Thanks for confirming! I was not sure if you meant the exact pattern or just a reference to 7.x stack.