does anyone know where I can find all the data that I imported to elasticsearch through logstash? Where are they stored? I want to delete all indices but cant find them anywhere. When I try to delete them in Kibana, they are still there. I just downloaded zip files from Elasticsearch, Logstash and Kibana and run in directly from the batch file. Did not use any installation.There is a folder data in the elasticsearch folder, i can see the indices , even if I delete them from there, they are still somewhere and taking so much disk space. Any solution for this? Im working on windows 10.
2
-
Could you please tell us what you mean by deleting indices in Kibana (what do you do exactly?)glenacota– glenacota2020-02-19 11:20:36 +00:00Commented Feb 19, 2020 at 11:20
-
I was meaning Indexes, sorry. Delete them from Saved Objects. My Disk Space is full from all the stuff that I ingested through logstash, cant find them in my laptop and delete them.mathersbe– mathersbe2020-02-19 11:47:19 +00:00Commented Feb 19, 2020 at 11:47
Add a comment
|
2 Answers
In your comment, you clarified that what you are deleting in Kibana is not actual data, but only the index patterns (that's what you have in "Saved Objects") - see Kibana documentation.
If you want to delete data from Kibana, you would need to go to the Dev Tools > Console page (see Kibana documentation | Console), and use the Delete index API to delete your indices. E.g., by running something like
DELETE <your_index>
If you don't know the names of your indices, you can run first the following command in the Dev Tools > Console:
GET _cat/indices
1 Comment
xeraa
You can also delete all indices with
DELETE * (unless you disable wildcard deletes), but be careful — this will really remove everything including the .kibana index with all your visualizations, dashboards,...Here is a bash script to delete certain indices programmatically from Opensearch, it is pretty risky to go for the delete all option, that's not recommended.
#!/bin/bash
curl --request GET \
--url https://<domain>/_cat/indices \
--<auth headers>
cat temp | awk '{print $3}' | grep <filterterm> > list
cat list | while read line; do
echo Removing index: $line ..;
curl --request DELETE \
--url https://<domain>/$line \
--<auth headers>
done
1 Comment
David Stone
For the lazy that want to copy/paste one line to delete everything on localhost
curl --request GET --url http://localhost:9200/_cat/indices | awk '{print $3}' | while read line; do echo Removing index: $line ..; curl --request DELETE --url http://localhost:9200/$line; done