# Remove system indices

**URL:** <https://discuss.elastic.co/t/remove-system-indices/371930>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [December 12, 2024, 6:54pm UTC](https://discuss.elastic.co/t/remove-system-indices/371930 "2024-12-12T18:54:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [December 12, 2024, 6:54pm UTC](https://discuss.elastic.co/t/remove-system-indices/371930/1 "2024-12-12T18:54:34Z")

</div>

I am trying to remove old system indices from kibana but it gives me errro  
".kibana\_7.12.0\_001"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/ebab808e9ee5aa9a449ec121ebdc00306ea21c1f.png)

when I try to login as kibana\_system it does not allow me to login. How do I remove these old indices?

Reason I want to remove this is because kibana upgrade is failing with message

[2024-12-12T12:32:51.811-06:00][FATAL][root] Reason: Unable to complete saved object migrations for the [.kibana] index: Migration failed because some documents were found which use unknown saved object types: epm-packages-assets,epm-packages,ingest-download-sources,ingest-outputs,ingest\_manager\_settings

I can start kibana by adding following line. but would like to remove old stuff now.  
migrations.discardUnknownObjects: "8.16.1"

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2024, 9:26pm UTC](https://discuss.elastic.co/t/remove-system-indices/371930/2 "2024-12-12T21:26:46Z")

</div>

What version are you on?

In short, you need to create a role with

"allow\_restricted\_indices" : true

Then create a user with that role

Then log in and do what you want to do.

This is the new security method to keep people from accidentally deleting system indices.

See here

> **[Defining roles | Elasticsearch Guide \[8.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html)**

> Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If however, for administrative purposes, you need to create a role with privileges covering restricted indices, you must set this field to true (default is false), and then the names field will cover the restricted indices as well.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [December 12, 2024, 9:35pm UTC](https://discuss.elastic.co/t/remove-system-indices/371930/3 "2024-12-12T21:35:49Z")

</div>

I am on 8.5 and was upgrading 8.16.1 and had this issue. I know older .kibana index are not used. I have deleted them in past. as every one has version

all 7.X index are useless and kibana is not able to convert it and hence kibana won't start

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2024, 9:42pm UTC](https://discuss.elastic.co/t/remove-system-indices/371930/4 "2024-12-12T21:42:29Z")

</div>

You have to use the method above in order to delete them. That's what it's there forYou have to use the method above in order to delete them. That's what it's there for

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [December 12, 2024, 9:49pm UTC](https://discuss.elastic.co/t/remove-system-indices/371930/5 "2024-12-12T21:49:07Z")

</div>

great created user and deleted them. I just want to make sure when I upgrade another cluster I take care this before hand that way downtime is minimum