Delete Elasticsearch indexes to reclaim storage, correct mappings, or remove stale data. This operation carries risk. This guide defines methods, timing, and practices to maintain cluster health.
This guide provides examples, scenarios, and guidance for developers and DevOps professionals.
To delete an index, send DELETE /my_index through the REST API or Kibana Dev Tools. Deletion is permanent, and Elasticsearch has no built-in undo.
What “Delete Index in Elasticsearch” Means
Deleting an index removes all documents, shards, and metadata. Kibana objects, such as dashboards and data views, remain. This action is permanent. Elasticsearch has no built-in undo function. ElasticPulse
This action is similar to dropping a database in a relational system. It is rapid and complete. Exercise caution.
Reasons to Delete an Index
Valid scenarios include:
- Incorrect mappings. For example, a field set as a keyword instead of text.
- Excessive index size causing performance issues or storage constraints.
- Obsolete or test data. This includes logs and outdated datasets.
- Retention policies. This ensures compliance with data lifecycle requirements.
Sematext lists common use cases: mapping conflicts, oversized indexes, and unused indices. The Linux Code cites rapid index growth and data removal for compliance and efficiency.
How to Delete an Index in Elasticsearch
REST API via cURL or Kibana Dev Tools
Use the DELETE endpoint.
DELETE /my_index
Execute with cURL.
curl -X DELETE "localhost:9200/my_index?pretty"
Wildcards and multiple index deletion
DELETE /logs-2025-08-*/?pretty
DELETE /index1,index2,index3
Sematext provides examples for simple and wildcard deletion. Better Stack details REST API usage.
Kibana Dev Tools Console
Delete an index in the Kibana Dev Tools console:
DELETE /demo_index
Use wildcards, such as DELETE /index*, to delete multiple indexes. See the ObjectRocket documentation for Kibana deletion methods.
Curator and Elasticsearch-py Scripts
Curator (Command-Line Automation)
Curator executes scheduled index cleanup. The following YAML configuration deletes indices older than 30 days:
actions:
1:
action: delete_indices
Delete indices older than 30 days.
Options:
ignore_empty_list: True
allow_ilm_indices: False
Filters:
filtertype: age
source: creation_date
direction: older
unit: days
value: 30
Run the command using the curator configuration and action files
Custom Python Scripts
from elasticsearch import Elasticsearch
es = Elasticsearch(["http://localhost:9200"])
indices = es.cat.indices(index="logs-2025-*", format="json")
for idx in indices:
es.indices.delete(index=idx['index'])
print(f"Deleted index: {idx['index']}")
Better Stack documents this script-based approach. See Better Stack.
Automate Deletion With Index Lifecycle Management (ILM)
ILM defines policies to rollover, shrink, and delete indices. Policies trigger based on age, size, or other conditions.
Example ILM policy:
PUT /_ilm/policy/delete-old-indices
{
"phases": {
"hot": {}
"delete": {
"min_age": "30d",
"actions": {
"delete": {}
}
}
}
}
Apply the policy to the index.
PUT /my_index/_settings
{
"index.lifecycle.name": "delete-old-indices"
}
,
Automates index deletion. Removes manual effort. See Better Stack.
Sematext confirms ILM improves age-based deletion. See Sematext.
Security Onion (April 2025) advises disabling legacy scripts in multi-node environments. Use ILM to prevent excessive deletion. See Security Onion Blog.
Best Practices and Safeguards
- Verify index names. Prevent accidental mass deletion.
- Create a backup or snapshot before deletion. Deletion is irreversible.
- Monitor cluster health. Deleting large indices triggers shard rebalancing.
- Use index aliases to switch indices without downtime.
- Limit wildcard use, especially _all, unless verified.
Verify permissions for system or restricted indices. These indices require special privileges.
Common Errors When You Delete an Elasticsearch Index
| Issue | Description | Solution |
|---|---|---|
| Deleting the current write index in a data stream | Not allowed until index rollover | Perform rollover first, then delete the previous index Elastic Sematext |
| No “acknowledged” response confusion | People worry index still exists | Acknowledged=true means successful deletion Stack Overflow |
| Restricted system indices (e.g., reporting) | Permission errors | Assign allow_restricted_indices : true in API key/role . Discuss the Elastic Stack |
| Legacy deletion scripts on clusters | May delete too much | Disable and rely on ILM or manual deletion , Security Onion Blog |
Related reading: Elasticsearch capacity planning and shard sizing and troubleshooting Elasticsearch errors.
Conclusion and Key Points
- Delete Elasticsearch indices using the REST API, Kibana, scripts, or ILM.
- Use the REST API or Kibana for one-off deletions. Use Curator or scripts for scheduled cleanup.
- ILM provides the safest automation through lifecycle policies.
- Back up data, monitor activity, and verify deletion.
Check permissions and index stream status. Note write blocks and restricted indices.
Quick reference
Delete one index via REST
DELETE /my_index
2. Delete Indexes Using Wildcards
DELETE /logs-*
3. Configure ILM Policy for Auto-Deletion After 30 Days
PUT /_ilm/policy/delete-old
{
"phases": {
"hot": {},
"delete": { "min_age": "30d", "actions": { "delete": {} } }
}
}
PUT /logs-*/_settings
{ "index.lifecycle.name": "delete-old" }
# 4. Curator configuration: delete indices older than 30 days
actions:
1:
action: delete_indices
filters:
- filtertype: age
source: creation_date
direction: older
unit: days
value: 30
Ready to delete Elasticsearch indices safely?
Need support for ILM policies or backup strategies?
Download the Free Elasticsearch Deletion & ILM Toolkit. It includes ready-to-use policies, Curator configs, and verification scripts.
Contact Us