> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Elasticsearch log indices

> Check the health of Elasticsearch log indices in Astro Private Cloud, and delete indices you no longer need.

Astro Private Cloud (APC) stores task logs and platform logs in Elasticsearch. APC 1.0 removed Kibana, so you administer the log indices with `kubectl` and the Elasticsearch REST API.

This page shows you how to list indices, check their health, delete indices that you no longer need, and set the retention period that deletes old indices automatically.

<Note>
  The `elasticsearch.<base-domain>` endpoint doesn't work for these tasks. The NGINX proxy in front of Elasticsearch allows only the `_search`, `_count`, `_bulk`, `_cluster/health`, and `_cluster/state/version` paths, and it rewrites the first three so that each caller reads only its own indices. The proxy denies every other path, including `_cat` and index deletion. Run the commands in this document from inside the cluster.
</Note>

## Prerequisites

* `kubectl` access to the namespace where you installed the APC platform.
* The name of your platform release. Run `helm ls -A` to find it.

## Connect to the Elasticsearch API

Each Elasticsearch client Pod serves the REST API on port 9200. `kubectl exec` runs the request inside the Pod, so the network policy that protects Elasticsearch doesn't block it.

1. Set the namespace and find a client Pod:

   ```bash wrap theme={null}
   export NAMESPACE=<your-platform-namespace>
   export ES_POD=$(kubectl get pods -n $NAMESPACE -l component=elasticsearch,role=client -o jsonpath='{.items[0].metadata.name}')
   ```

2. Confirm that the API answers:

   ```bash wrap theme={null}
   kubectl exec -n $NAMESPACE $ES_POD -c es-client -- curl -s localhost:9200
   ```

   The response includes the cluster name and the Elasticsearch version.

The rest of this document uses these two variables.

## Index names

Vector creates one index for each Deployment for each day. The index name has three parts:

```text theme={null}
<prefix>.<deployment-release-name>.<YYYY.MM.DD>
```

For example, `fluentd.spacious-orbit-4832.2026.02.14`.

The prefix depends on your logging configuration:

| Configuration                                                           | Prefix     |
| ----------------------------------------------------------------------- | ---------- |
| DaemonSet logging, which is the default                                 | `fluentd`  |
| Sidecar logging, when `global.logging.loggingSidecar.enabled` is `true` | `vector`   |
| Any value set in `global.logging.indexNamePrefix`                       | That value |

## List indices and check their health

List every index with its health, document count, and size on disk:

```bash wrap theme={null}
kubectl exec -n $NAMESPACE $ES_POD -c es-client -- \
  curl -s "localhost:9200/_cat/indices?v&h=health,status,index,docs.count,store.size&s=index"
```

The response looks like the following example:

```text theme={null}
health status index                                  docs.count store.size
green  open   fluentd.spacious-orbit-4832.2026.02.13     418293    412.8mb
green  open   fluentd.spacious-orbit-4832.2026.02.14     392014    388.1mb
```

An index is `green` when all of its shards are assigned, `yellow` when a replica shard is unassigned, and `red` when a primary shard is missing. A `red` index can't serve all of its logs.

To list only the indices that need attention, filter on health:

```bash wrap theme={null}
kubectl exec -n $NAMESPACE $ES_POD -c es-client -- \
  curl -s "localhost:9200/_cat/indices?v&health=red"
```

To find the indices that use the most disk, sort by size:

```bash wrap theme={null}
kubectl exec -n $NAMESPACE $ES_POD -c es-client -- \
  curl -s "localhost:9200/_cat/indices?v&h=index,docs.count,store.size&s=store.size:desc"
```

To see the health of the cluster and how much disk each node uses:

```bash wrap theme={null}
kubectl exec -n $NAMESPACE $ES_POD -c es-client -- curl -s "localhost:9200/_cluster/health?pretty"
kubectl exec -n $NAMESPACE $ES_POD -c es-client -- curl -s "localhost:9200/_cat/allocation?v"
```

## Delete an index

<Warning>
  Deleting an index permanently deletes the logs in it. You can't undo the operation. Forward your logs to external storage first if you must keep them. See [Forward logs to Amazon S3](/docs/astro-private-cloud/v-2-x/logs-to-s3).
</Warning>

Delete one index by name:

```bash wrap theme={null}
kubectl exec -n $NAMESPACE $ES_POD -c es-client -- \
  curl -s -XDELETE "localhost:9200/fluentd.spacious-orbit-4832.2026.02.13"
```

Elasticsearch answers `{"acknowledged":true}`.

## Delete several indices

Elasticsearch 8 sets `action.destructive_requires_name` to `true`, and APC keeps that default. A wildcard such as `fluentd.*` therefore fails with `Wildcard expressions or all indices are not allowed`. Name each index that you want to delete.

1. Review the names first. A `GET` request accepts a wildcard, so you can list the candidates:

   ```bash wrap theme={null}
   kubectl exec -n $NAMESPACE $ES_POD -c es-client -- \
     curl -s "localhost:9200/_cat/indices/fluentd.*.2026.01.*?h=index,store.size&s=index"
   ```

2. Delete the reviewed names in one request, separated by commas:

   ```bash wrap theme={null}
   kubectl exec -n $NAMESPACE $ES_POD -c es-client -- \
     curl -s -XDELETE "localhost:9200/fluentd.spacious-orbit-4832.2026.01.02,fluentd.spacious-orbit-4832.2026.01.03"
   ```

## Verify the result

After a delete, check the health of the cluster:

```bash wrap theme={null}
kubectl exec -n $NAMESPACE $ES_POD -c es-client -- curl -s "localhost:9200/_cluster/health?pretty"
```

`status` is `green` when every shard is assigned, and `unassigned_shards` is `0`. List the indices again to confirm that the deleted ones are gone.

## Delete old indices automatically

APC runs an Elasticsearch curator CronJob named `<your-platform-release-name>-elasticsearch-curator`. By default it runs at 01:00 every day and deletes indices that are more than 10 days old. Curator reads the date from the index name, so it only deletes indices that follow the `<prefix>.<deployment-release-name>.<YYYY.MM.DD>` pattern.

To change the retention period, set the following values in your `values.yaml` file:

```yaml wrap theme={null}
elasticsearch:
  curator:
    enabled: true
    schedule: "0 1 * * *"
    age:
      timestring: "%Y.%m.%d"
      unit: "days"
      unit_count: 10
```

Apply the change. See [Apply a platform configuration change](/docs/astro-private-cloud/v-2-x/apply-platform-config).

To check the most recent run:

```bash wrap theme={null}
kubectl get jobs -n $NAMESPACE | grep elasticsearch-curator
kubectl logs -n $NAMESPACE -l app=elasticsearch-curator --tail=50
```