弹性搜索-如何检查kibana中是否使用了索引

Question

I am struggling with low disc space due to too many unused indices in ELK stack (ver 5.2). I am wondering how to check usage of particular index ie if it's used in visualization?

btw. I have already checked if there are aliases associated with it via GET _cat/aliases?v

thanks in advance!

Answer 1

I managed to find the solution,

the governing index for all kibana used indices is .kibana which can found in Discover menu/index. Then all I had to do is to look for "_type" filter and spotted that some indices just don't appear in that search or only have "_type": "index_pattern" - which clearly says that it's just an index and it's not used for anything.

The opposite case would be is where "_type" shows "visualization","saved_Search" etc meaning that that particular index is actually used in kibana.