Elasticsearch Nodes & Indices Cache Directory (data/nodes/0/indices)

Bottom Line: DO NOT delete data/nodes/0/indices files manually from the filesystem. To safely delete Elasticsearch indices and free up SSD space, use the official Elasticsearch REST API DELETE /index_name endpoint.

Why Does Elasticsearch Indices Storage Exist?

Elasticsearch stores inverted Lucene search index segments, fielddata caches, and shard replicas inside /var/lib/elasticsearch/nodes/0/indices.

• Primary Purpose: High-speed full-text search indexing and log analytics storage.
• Storage Impact: Logstash, Beats, and Kibana logs (ILM policy) can inflate Elasticsearch storage to 10 GB to 100 GB+.
• Lucene Structure: Index files consist of immutable segment files (.doc, .tim, .tip, .fdx).

What Happens If You Delete Indices Files Directly?

• System Safety: ❌ DO NOT DELETE DIRECTLY. Manually deleting files inside nodes/0/indices causes cluster metadata corruption and unassigned shard errors.
• REST API Cleanup: Using DELETE /index_name removes search index segments cleanly without breaking cluster health.
• Reclaimed Storage: Deleting old indices frees 10 GB to 100 GB+ instantly.

How to Delete Elasticsearch Indices Safely (REST API)

Method 1: Delete an Index via Curl

curl -X DELETE "localhost:9200/logstash-2026.07.*?pretty"

Method 2: Use Elasticsearch Curator CLI

curator_cli delete_indices --repository my_backup --filter_list '{"filtertype":"age","source":"name","direction":"older","unit":"days","unit_count":30,"timestring":"%Y.%m.%d"}'

Frequently Asked Questions (FAQ)

How do I check which Elasticsearch indices use the most storage?

Run curl -X GET "localhost:9200/_cat/indices?v&s=store.size:desc" in your terminal.

Will deleting an index delete my raw logs permanently?

Yes. Deleting an index removes all search documents stored within that index. Ensure you take a snapshot via POST /_snapshot/ before deleting.