CODEWITHSUNDEEP
elasticsearchlogstash
javakurious
javakurious

Reputation: 517

Elasticsearch monitoring indices

I am new to ELK stack and playing around with it in a development environment. That's why I end up deleting an index (DELETE /index_name) and recreating multiple times. Deleting an index that I created works fine, but I notice that there are few lingering system indices, like .monitoring-es-2-2017.02.05.

Screenshot of system indices

NOTE: I have seen the suggestion to use /* to delete everything. But that sounds risky. I don't want to delete index pattern or Visualization or the templates. I only want to delete the data and repopulate with updated data.

Upvotes: 12

Views: 10387

Answers (1)

Will Barnwell
Will Barnwell

Reputation: 4089

These indices are created by the Elastic X-Pack monitoring component. X-Pack components are elasticsearch plugins and thus store their data, like Kibana, in elasticsearch. Unlike the .kibana index these indices are created daily because they contain timeseries monitoring data about elasticsearch's performance. Deleting them will have no impact on your other indices.

As @Val pointed out in the comments, you can use /.monitoring-* to only delete these indices and ensure you do not wipe out any other indices, you may find the data in these indices useful as you evaluate the ELK stack and leaving them should not negatively impact you except in the disk space and small amount of memory they occupy.

Upvotes: 14

Related Questions