ELK 将数据 stream 转换回常规索引

Question

I want to use regular index instead of datastream, but unable to delete/update it neither from Kibana UI nor with a help of direct ES api call

    "reason" : "composable template [logs_template] with index patterns [new-pattern*], priority [200] would cause data streams [logstash-2020.12.24] to no longer match a data stream template"

I cannot

• delete datastream or underlying index (it's got recreated)
• delete index template used to create data stream
• reassign index template to point to some dummy index and then delete the above (error below)

How can I migrate back to the regular index and discard data stream settings?

Kibana v 7.9.2 / ES 7.9.2

Answer 1

I was able to delete data stream first and the corresponding index template by running ES/Kibana connection on different port.

# http.port: 9201
# /etc/elasticsearch/elasticsearch.yml
# /etc/kibana/kibana.yml
$ systemctl restart kibana
$ systemctl restart elasticsearch

This way datastream was not constantly recreated as nobody was writing to the new Elastic endpoint, so no issue occurs.

Answer 2

I faced the same task. I stoped Logstash to not allow to recreate datastream's indices.

sudo systemctl stop logstash

I removed datastreams and changed index templates to not use data streams. After that I started Logstash .

sudo systemctl start logstash