diff --git a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-indices-delete-delete b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-indices-delete-delete
index 5577fde3f..44f27e9d4 100755
--- a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-indices-delete-delete
+++ b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-indices-delete-delete
@@ -46,7 +46,7 @@ while overlimit && [[ $ITERATION -lt $MAX_ITERATIONS ]]; do
     # We extract the data stream name using the pattern below
     DATASTREAM_PATTERN="logs-[a-zA-Z_.]+-[a-zA-Z_.]+"
     DATASTREAM=$(echo "${INDEX}" | grep -oE "$DATASTREAM_PATTERN")
-    if [[ "$INDEX" =~ "^so-.*" ]]; then
+    if [[ "$INDEX" =~ "^logstash-.*|so-.*" ]]; then
       printf "\n$(date) - Used disk space exceeds LOG_SIZE_LIMIT (${LOG_SIZE_LIMIT_GB} GB) - Deleting ${INDEX} index...\n" >> ${LOG}
       /usr/sbin/so-elasticsearch-query ${INDEX} -XDELETE >> ${LOG} 2>&1
     else