Why is that after deleting an index in logstash, Kibana still displays it?

Question

I have 2 indexes movie_indexer and trial_indexer.

I used the following command to delete movie_indexer:

curl -XDELETE "http://localhost:9200/movie_indexer/"

Then i reran Kibana. It still showed the index and its values.

When i used

curl -XDELETE "http://localhost:9200/.kibana" 

after that trial_indexer was missing.

Note: After using latter command, i could create the index pattern for trial_indexer but not for movie_indexer.

I want to delete the specific index w/o the need to recreate an index pattern for undeleted indexes. How can i do that? (i'm using windows)

Answer 1

That's normal because Kibana will store an index pattern and the associated field settings from the mapping inside his own index called .kibana.

If you want to delete the movie_indexer index (containing the data) and the associated index pattern in Kibana (containing the Kibana settings for that index), you can do so by issuing two queries, namely the one you already did to delete the data

curl -XDELETE "http://localhost:9200/movie_indexer/"

and another one to delete the index pattern in Kibana, where pattern_name is the name you gave to the index pattern you wish to delete (by default it's the same name as your index, i.e. movie_indexer)

curl -XDELETE "http://localhost:9200/.kibana/index-pattern/pattern_name"

Note that you can also delete the index pattern directly in Kibana by going into Settings > Indices, then picking the index pattern you want and clicking on the "remove index pattern" button