Free disk space via the Elastic Cloud API console

When a deployment fills up, Kibana usually becomes unreachable before you can open Dev Tools. Elastic Cloud exposes an API Console that talks straight to Elasticsearch and works even while Kibana is unavailable.

Open it from cloud.elastic.co → your deployment → Elasticsearch → API Console. All requests below run there.

1. Confirm the cluster is full

GET /_cat/allocation?v

Look at disk.percent — anything ≥ 90% is why writes (and Kibana’s .kibana_* indices) are blocked.

2. Find the biggest indices

GET /_cat/indices?v&s=store.size:desc&h=index,health,rep,docs.count,store.size,pri.store.size

Sorted largest first, only the columns you need. Sizes are human-readable (1.2gb, 340mb); rep is the replica count, and store.size vs pri.store.size shows how much of the footprint is replicas. Time-series indices (logs-2026.01.*, filebeat-7.17.0-2024.*, etc.) are the usual culprits.

3. Delete what you don’t need

Single index:

DELETE /logs-2026.01.15

Wildcard (be careful — this is irreversible):

DELETE /logs-2026.01.*

If wildcard deletes are refused, allow them for this call:

DELETE /logs-2026.01.*?expand_wildcards=open,closed

and/or temporarily relax the cluster setting:

PUT /_cluster/settings
{ "transient": { "action.destructive_requires_name": false } }

Set it back to true when you’re done.

4. Lift the read-only flood-stage block

Once disk drops below the flood-stage watermark, indices stay read-only until you clear the block explicitly:

PUT /_all/_settings
{ "index.blocks.read_only_allow_delete": null }

Re-check GET /_cat/allocation?v — disk.percent should be down and Kibana should come back within a minute or two.

Data streams

If the “indices” you see are prefixed .ds- (e.g. .ds-logs-myapp-default-2026.01.15-000123), they’re backing indices of a data stream — don’t DELETE them directly, the data stream will end up in a broken state. List the streams instead:

GET /_data_stream

Drop a whole stream (irreversible — all backing indices go with it):

DELETE /_data_stream/logs-myapp-default

To trim old backing indices without dropping the stream, attach an ILM policy with a delete phase at e.g. 30 days; existing old indices age out on the next ILM run.

Prevention

Configure Index Lifecycle Management (ILM) so old indices roll over and delete themselves instead of needing a manual cleanup next time.