Remove system indices

Elastic Stack Elasticsearch
1

I am trying to remove old system indices from kibana but it gives me errro
".kibana_7.12.0_001"

image
image413×262 18.5 KB

when I try to login as kibana_system it does not allow me to login. How do I remove these old indices?

Reason I want to remove this is because kibana upgrade is failing with message

[2024-12-12T12:32:51.811-06:00][FATAL][root] Reason: Unable to complete saved object migrations for the [.kibana] index: Migration failed because some documents were found which use unknown saved object types: epm-packages-assets,epm-packages,ingest-download-sources,ingest-outputs,ingest_manager_settings

I can start kibana by adding following line. but would like to remove old stuff now.
migrations.discardUnknownObjects: "8.16.1"

2

What version are you on?

In short, you need to create a role with

"allow_restricted_indices" : true

Then create a user with that role

Then log in and do what you want to do.

This is the new security method to keep people from accidentally deleting system indices.

See here

Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If however, for administrative purposes, you need to create a role with privileges covering restricted indices, you must set this field to true (default is false), and then the names field will cover the restricted indices as well.

1 Like
3

I am on 8.5 and was upgrading 8.16.1 and had this issue. I know older .kibana index are not used. I have deleted them in past. as every one has version

all 7.X index are useless and kibana is not able to convert it and hence kibana won't start

4

You have to use the method above in order to delete them. That's what it's there forYou have to use the method above in order to delete them. That's what it's there for

5

great created user and deleted them. I just want to make sure when I upgrade another cluster I take care this before hand that way downtime is minimum

1 Like