How to delete an index in Elasticsearch

Deleting an index in Elasticsearch permanently removes that index's documents, shard data, mappings, settings, and metadata. It fits one-off cleanup after a migration, a bad test import, or a retired time-based index when the data is no longer needed.

The Delete index API targets concrete index names through DELETE /{index}. It does not accept aliases, and Elastic's default destructive-action setting blocks wildcard deletes and _all unless action.destructive_requires_name is disabled, so inspect the exact target before sending DELETE.

A deleted index can be recovered only from a snapshot or another copy of the data. Confirm the index is not the current write target for an application, alias, or data stream; Elasticsearch rejects deletion of a data stream's current write index until the stream rolls over to a new backing index. Secured clusters need the delete_index privilege and the cluster HTTPS endpoint plus authentication.

1. List the indices before choosing the target name.

   $ curl -sS --fail "http://localhost:9200/_cat/indices?v&s=index&h=health,status,index,pri,rep,docs.count,store.size"
   health status index                pri rep docs.count store.size
   green  open   app-events-2026.03     1   0          1      5.5kb
   green  open   app-events-2026.04     1   0          1      5.5kb
   green  open   audit-events-2026.04   1   0          1      5.5kb

   The _cat APIs are meant for human-readable terminal checks. Replace http://localhost:9200 with the real cluster endpoint and add authentication options when security is enabled.

2. Inspect the target index for aliases, data stream membership, and shard settings.

   $ curl -sS --fail "http://localhost:9200/app-events-2026.03?pretty&filter_path=*.aliases,*.data_stream,*.settings.index.number_of_replicas,*.settings.index.number_of_shards"
   {
     "app-events-2026.03" : {
       "aliases" : { },
       "settings" : {
         "index" : {
           "number_of_shards" : "1",
           "number_of_replicas" : "0"
         }
       }
     }
   }

   If aliases is populated, confirm applications no longer route writes or reads through that alias to the target index. If data_stream appears, check whether the backing index is still the stream's current write index.

3. Delete the concrete index name.

   $ curl -sS --fail -X DELETE "http://localhost:9200/app-events-2026.03?pretty"
   {
     "acknowledged" : true
   }

   Deleting an index permanently removes its documents, shard data, mappings, settings, and metadata. Restore requires a snapshot or another copy of the data.

4. Check the deleted index path for HTTP 404.

   $ curl -sS -o /dev/null -w "%{http_code}\n" "http://localhost:9200/_cat/indices/app-events-2026.03?v"
   404

   HTTP 200 means the index still exists or the request reached a different cluster endpoint than the delete request.

5. List the surviving indices.

   $ curl -sS --fail "http://localhost:9200/_cat/indices/app-events-2026.04,audit-events-2026.04?v&s=index&h=health,status,index,pri,rep,docs.count,store.size"
   health status index                pri rep docs.count store.size
   green  open   app-events-2026.04     1   0          1      5.5kb
   green  open   audit-events-2026.04   1   0          1      5.5kb

   Use an ILM policy for recurring retention so old time-based indices are deleted on schedule instead of through manual one-off requests.