How to delete an index in Elasticsearch

Deleting an index in Elasticsearch permanently removes that index's documents, shard data, mappings, settings, and metadata. It fits one-off cleanup after a migration, a bad test import, or a retired time-based index when the data is no longer needed.

The Delete index API targets concrete index names through DELETE /{index}. It does not accept aliases, and Elastic's default destructive-action setting blocks wildcard deletes and _all unless action.destructive_requires_name is disabled, so inspect the exact target before sending DELETE.

A deleted index can be recovered only from a snapshot or another copy of the data. Confirm the index is not the current write target for an application, alias, or data stream; Elasticsearch rejects deletion of a data stream's current write index until the stream rolls over to a new backing index. Secured clusters need the delete_index privilege and the cluster HTTPS endpoint plus authentication.

Steps to delete an Elasticsearch index:

List the indices before choosing the target name.

$ curl -sS --fail "http://localhost:9200/_cat/indices?v&s=index&h=health,status,index,pri,rep,docs.count,store.size"
health status index                pri rep docs.count store.size
green  open   app-events-2026.03     1   0          1      5.5kb
green  open   app-events-2026.04     1   0          1      5.5kb
green  open   audit-events-2026.04   1   0          1      5.5kb

The _cat APIs are meant for human-readable terminal checks. Replace http://localhost:9200 with the real cluster endpoint and add authentication options when security is enabled.

Inspect the target index for aliases, data stream membership, and shard settings.

$ curl -sS --fail "http://localhost:9200/app-events-2026.03?pretty&filter_path=*.aliases,*.data_stream,*.settings.index.number_of_replicas,*.settings.index.number_of_shards"
{
  "app-events-2026.03" : {
    "aliases" : { },
    "settings" : {
      "index" : {
        "number_of_shards" : "1",
        "number_of_replicas" : "0"
      }
    }
  }
}

If aliases is populated, confirm applications no longer route writes or reads through that alias to the target index. If data_stream appears, check whether the backing index is still the stream's current write index.

Delete the concrete index name.
```
$ curl -sS --fail -X DELETE "http://localhost:9200/app-events-2026.03?pretty"
{
  "acknowledged" : true
}
```
Deleting an index permanently removes its documents, shard data, mappings, settings, and metadata. Restore requires a snapshot or another copy of the data.
Check the deleted index path for HTTP 404.
```
$ curl -sS -o /dev/null -w "%{http_code}\n" "http://localhost:9200/_cat/indices/app-events-2026.03?v"
404
```
HTTP 200 means the index still exists or the request reached a different cluster endpoint than the delete request.

List the surviving indices.

$ curl -sS --fail "http://localhost:9200/_cat/indices/app-events-2026.04,audit-events-2026.04?v&s=index&h=health,status,index,pri,rep,docs.count,store.size"
health status index                pri rep docs.count store.size
green  open   app-events-2026.04     1   0          1      5.5kb
green  open   audit-events-2026.04   1   0          1      5.5kb

Use an ILM policy for recurring retention so old time-based indices are deleted on schedule instead of through manual one-off requests.