elastic/elasticsearch · error · ResourceNotFoundException

data streams {} not found

Error message

data streams {} not found

What it means

Thrown by TransportDeleteDataStreamAction when the resolved set of data streams to delete is empty AND the request did not originally contain wildcard expressions. A wildcard request that matches nothing returns silently; an explicit name request that matches nothing is treated as a user error and raises ResourceNotFoundException.

Source

Thrown at modules/data-streams/src/main/java/org/elasticsearch/datastreams/action/TransportDeleteDataStreamAction.java:151

    static ClusterState removeDataStream(
        IndexNameExpressionResolver indexNameExpressionResolver,
        ProjectState projectState,
        DeleteDataStreamAction.Request request,
        Consumer<String> systemDataStreamAccessValidator,
        Settings settings
    ) {
        final ProjectMetadata project = projectState.metadata();
        List<String> names = getDataStreamNames(indexNameExpressionResolver, project, request.getNames(), request.indicesOptions());
        Set<String> dataStreams = new HashSet<>(names);
        for (String dataStreamName : dataStreams) {
            systemDataStreamAccessValidator.accept(dataStreamName);
        }

        if (dataStreams.isEmpty()) {
            if (request.isWildcardExpressionsOriginallySpecified()) {
                return projectState.cluster();
            } else {
                throw new ResourceNotFoundException("data streams " + Arrays.toString(request.getNames()) + " not found");
            }
        }

        return MetadataDataStreamsService.deleteDataStreams(
            projectState,
            dataStreams.stream().map(project.dataStreams()::get).collect(Collectors.toSet()),
            settings
        );
    }

    @Override
    protected ClusterBlockException checkBlock(DeleteDataStreamAction.Request request, ClusterState state) {
        return state.blocks().globalBlockedException(projectResolver.getProjectId(), ClusterBlockLevel.METADATA_WRITE);
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Verify the data stream name exists via GET _data_stream before deleting.
2. If partial/wildcard deletion is intended, use a wildcard expression so missing matches do not error.
3. Check you are targeting the correct cluster/project.

Example fix

// before
DELETE _data_stream/missing-name
// after (verify first)
GET _data_stream/missing-name
DELETE _data_stream/logs-*

// Resolve names first; only delete if non-empty or if wildcards were used.
const existing = await es.indices.getDataStream({ name });
const names = existing.data_streams.map(d => d.name);
if (names.length === 0 && !/[*?,]/.test(name)) {
  throw new Error(`data streams [${name}] not found`);
}

When it happens

Trigger: Calling DELETE _data_stream/<name> where <name> does not match any existing data stream and is not a wildcard (no * or ,). Calling with multiple explicit names none of which exist.

Common situations: Typo in the data stream name; deleting an already-deleted stream; race where the stream was removed between resolve and delete; environment mismatch (wrong cluster/project).

Related errors

• Data stream [{}] not found
• Database configuration not found: {}
• backing index [%s] in tsdb mode doesn't have the [%s] index
• Cannot add dynamic templates that define dimension fields on
• Expected at most one {} implementation, found: {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/2356706fcc322a7e. Report an issue: GitHub.