Skip to main content
Astro Private Cloud (APC) stores task logs and platform logs in Elasticsearch. APC 1.0 removed Kibana, so you administer the log indices with kubectl and the Elasticsearch REST API. This page shows you how to list indices, check their health, delete indices that you no longer need, and set the retention period that deletes old indices automatically.
The elasticsearch.<base-domain> endpoint doesn’t work for these tasks. The NGINX proxy in front of Elasticsearch allows only the _search, _count, _bulk, _cluster/health, and _cluster/state/version paths, and it rewrites the first three so that each caller reads only its own indices. The proxy denies every other path, including _cat and index deletion. Run the commands in this document from inside the cluster.

​
Prerequisites

  • kubectl access to the namespace where you installed the APC platform.
  • The name of your platform release. Run helm ls -A to find it.

​
Connect to the Elasticsearch API

Each Elasticsearch client Pod serves the REST API on port 9200. kubectl exec runs the request inside the Pod, so the network policy that protects Elasticsearch doesn’t block it.
  1. Set the namespace and find a client Pod:
  2. Confirm that the API answers:
    The response includes the cluster name and the Elasticsearch version.
The rest of this document uses these two variables.

​
Index names

Vector creates one index for each Deployment for each day. The index name has three parts:
For example, fluentd.spacious-orbit-4832.2026.02.14. The prefix depends on your logging configuration:

​
List indices and check their health

List every index with its health, document count, and size on disk:
The response looks like the following example:
An index is green when all of its shards are assigned, yellow when a replica shard is unassigned, and red when a primary shard is missing. A red index can’t serve all of its logs. To list only the indices that need attention, filter on health:
To find the indices that use the most disk, sort by size:
To see the health of the cluster and how much disk each node uses:

​
Delete an index

Deleting an index permanently deletes the logs in it. You can’t undo the operation. Forward your logs to external storage first if you must keep them. See Forward logs to Amazon S3.
Delete one index by name:
Elasticsearch answers {"acknowledged":true}.

​
Delete several indices

Elasticsearch 8 sets action.destructive_requires_name to true, and APC keeps that default. A wildcard such as fluentd.* therefore fails with Wildcard expressions or all indices are not allowed. Name each index that you want to delete.
  1. Review the names first. A GET request accepts a wildcard, so you can list the candidates:
  2. Delete the reviewed names in one request, separated by commas:

​
Verify the result

After a delete, check the health of the cluster:
status is green when every shard is assigned, and unassigned_shards is 0. List the indices again to confirm that the deleted ones are gone.

​
Delete old indices automatically

APC runs an Elasticsearch curator CronJob named <your-platform-release-name>-elasticsearch-curator. By default it runs at 01:00 every day and deletes indices that are more than 10 days old. Curator reads the date from the index name, so it only deletes indices that follow the <prefix>.<deployment-release-name>.<YYYY.MM.DD> pattern. To change the retention period, set the following values in your values.yaml file:
Apply the change. See Apply a platform configuration change. To check the most recent run: