Reset Kibana to blank state

[rsk0]

On startup Kibana creates configuration in ES, and that config accumulates with web UI config changes, I believe.

Is there a way to zero out the Kibana config to start fresh? Or do I have to find every change and delete it manually?

[jsanz (Jorge Sanz)]

This is a full list of indices on a clean Elasticsearch 8.10.0-SNAPSHOT docker image build:

➜ curl -u elastic:changeme http://localhost:9210/_cat/indices\?expand_wildcards\=all\&v
health status index       uuid                   pri rep docs.count docs.deleted store.size pri.store.size dataset.size
green  open   .security-7 r1EWaXWcTTe447RzKR1YTg   1   0          9            0     30.4kb         30.4kb       30.4kb

So there's just a .security-7 index.

Now, after starting the corresponding Kibana container we get the following indices being created in ES (only getting the relevant columns):

curl -u elastic:changeme http://localhost:9203/_cat/indices\?expand_wildcards\=all\&v\&s\=index\&h\=index,docs.count,store.size
index                                                         docs.count store.size
.apm-agent-configuration                                               0       226b
.apm-custom-link                                                       0       226b
.apm-source-map                                                        0       226b
.ds-.kibana-event-log-8.10.0-snapshot-2023.09.06-000001                1      6.1kb
.ds-.logs-deprecation.elasticsearch-default-2023.09.06-000001          2     13.4kb
.ds-ilm-history-5-2023.09.06-000001                                   28     22.8kb
.internal.alerts-observability.apm.alerts-default-000001               0       226b
.internal.alerts-observability.logs.alerts-default-000001              0       226b
.internal.alerts-observability.metrics.alerts-default-000001           0       226b
.internal.alerts-observability.slo.alerts-default-000001               0       226b
.internal.alerts-observability.uptime.alerts-default-000001            0       226b
.internal.alerts-security.alerts-default-000001                        0       226b
.internal.alerts-stack.alerts-default-000001                           0       226b
.kibana-observability-ai-assistant-conversations-000001                0       226b
.kibana-observability-ai-assistant-kb-000001                           0       226b
.kibana_8.10.0_001                                                    22     62.9kb
.kibana_alerting_cases_8.10.0_001                                      1      6.6kb
.kibana_analytics_8.10.0_001                                          29      2.3mb
.kibana_ingest_8.10.0_001                                            138    291.2kb
.kibana_security_session_1                                             0       226b
.kibana_security_solution_8.10.0_001                                   2     24.3kb
.kibana_task_manager_8.10.0_001                                       27    233.4kb
.security-7                                                          188    718.7kb
.slo-observability.sli-v2                                              0       226b
.slo-observability.summary-v2                                          0       226b
.slo-observability.summary-v2.temp                                     0       226b
.transform-internal-007                                               30     95.8kb
.transform-notifications-000002                                       50     34.9kb

As you can see, Kibana generates many system indices and data streams. You may need to stop Kibana and clean all those new assets to return to a blank state.

[rsk0]

Happy anniversay, Jorge!

I'm going to try wiping out the complete list and see if that does it. I'll let you know what I find out.

Thanks!