Unable to delete indices

[mckenziemmack]

Version

2.4.100

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

64

RAM

251G

Storage for /

558G

Storage for /nsm

38T

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,

I am encountering difficulties when trying to manually delete indices. The indices I wish to remove are visible using the command sudo so-elasticsearch-shards-list, but I am unable to delete them.

When I attempt to delete the indices through the Kibana Dev Console with the command DELETE /.ds-logs-* I receive the following error:

{
  "error": {
    "root_cause": [
      {
        "type": "index_not_found_exception",
        "reason": "no such index [.ds-logs-suricata-so-2024.04.05-000059]",
        "resource.type": "index_or_alias",
        "resource.id": ".ds-logs-suricata-so-2024.04.05-000059",
        "index_uuid": "_na_",
        "index": ".ds-logs-suricata-so-2024.04.05-000059"
      }
    ],
    "type": "index_not_found_exception",
    "reason": "no such index [.ds-logs-suricata-so-2024.04.05-000059]",
    "resource.type": "index_or_alias",
    "resource.id": ".ds-logs-suricata-so-2024.04.05-000059",
    "index_uuid": "_na_",
    "index": ".ds-logs-suricata-so-2024.04.05-000059"
  },
  "status": 404
}

Additionally, when I try to delete using the command curl -X DELETE localhost:9200/.ds-logs-* I receive the following error:

curl: (52) Empty reply from server

I've tried this command on my manager node and the storage node the indices is stored on, receiving the same error.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Are you trying to delete all your indices? If not which ones?

[mckenziemmack]

Hello, I am trying to delete Suricata logs that are more than 60 days old.

[JhonShell]

create a role
curl -u 'user:pass' -k -XPUT https://localhost:9200/_security/role/grant_kibana_system_indices -H "Content-Type: application/json" -d '{"indices": [{"names": [".kibana*"], "privileges": ["all"], "allow_restricted_indices": true}]}'
create a user and add to this role
curl -u 'pass:pass' -k -XPOST https://localhost:9200/_security/user/kibanaindexuser -H "Content-Type: application/json" -d '{"password" : "pass","roles" : [ "superuser", "grant_kibana_system_indices" ]}'

then Try this:
curl --user 'user:#pass' -s -k -L -H "Content-Type: application/json" "https://localhost:9200/logs-detections.alerts-so" -XDELETE