Removing empty indices

[bbreer (Brad)]

I would like to remove these empty indices because I need to free up the shards.

I know this is a restricted data stream which may be why no matter what privileges i add to the role, I still can't delete them. Any one else run into this issue?

Thanks.

[covj12 (윤성 반)]

superuser can't touch restricted indices by default. Add a role with allow_restricted_indices: true scoped to just that index, then delete.

Indices privileges - Defining roles | Elasticsearch Guide [8.18] | Elastic

[bbreer (Brad)]

Thank you for takign the time to reply. Yes, I read that when I was googling. The problem is that the allow_restricted_indices privilege doesn't appear in the drop-down menu of index privileges able to be assigned to a role.

[leandrojmp (Leandro Pereira)]

You need to create a role manually, with a request on Dev Tools, something like this:

POST /_security/role/fleet_superuser
{
  "indices": [
    {
      "names": [ ".ds-.fleet-actions-*" ],
      "privileges": [ "all" ],
      "allow_restricted_indices": true
    }
  ]
}