# Auto-created spam index **URL:** \ **Category:** Elasticsearch\ **Created:** [March 13, 2014, 1:59am UTC](https://discuss.elastic.co/t/auto-created-spam-index/16342 "2014-03-13T01:59:31Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Daniel\_Guo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_guo/32/1725_2.png) [@Daniel\_Guo](https://discuss.elastic.co/u/Daniel_Guo)\ **Post date:** [March 13, 2014, 1:59am UTC](https://discuss.elastic.co/t/auto-created-spam-index/16342/1 "2014-03-13T01:59:31Z")
In my cluster, many spam indices are automatically created. Please look at the image below, only the index named "video" is created by myself. Anybody any ideas? thanks! [https://lh5.googleusercontent.com/-W8FKBOoV98Y/UyEQJucNThI/AAAAAAAAAXE/7w7I\_3\_hQqo/s1600/es.png](https://lh5.googleusercontent.com/-W8FKBOoV98Y/UyEQJucNThI/AAAAAAAAAXE/7w7I_3_hQqo/s1600/es.png) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7a2866d5-b294-46fc-ab3b-01c8048c45b7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7a2866d5-b294-46fc-ab3b-01c8048c45b7%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [March 13, 2014, 4:15am UTC](https://discuss.elastic.co/t/auto-created-spam-index/16342/2 "2014-03-13T04:15:55Z")
You are facing a very serious issue. You can easily solve the problem that is occurring in Elasticsearch, but the bigger problem that you are experiencing is that your server is exposed to the world. What is happening is that someone is scanning your system for known vulnerabilities. When these scans execute a PUT request, it is creating a document as a consequence. You can disable this behavior by setting action.auto\_create\_index to false. [1] That said, your Elasticsearch server is still accessible to anyone over the internet. It should be placed behind a firewall, or at the very least behind a proxy like nginx or even node.js. I do not think your system can be compromised by having a public Elasticsearch server, but your data will be. [1] > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. -- Ivan On Wed, Mar 12, 2014 at 6:59 PM, Daniel Guo [daniel5hbs@gmail.com](mailto:daniel5hbs@gmail.com) wrote: > In my cluster, many spam indices are automatically created. > > Please look at the image below, only the index named "video" is created by > myself. > > Anybody any ideas? thanks! > > [https://lh5.googleusercontent.com/-W8FKBOoV98Y/UyEQJucNThI/AAAAAAAAAXE/7w7I\_3\_hQqo/s1600/es.png](https://lh5.googleusercontent.com/-W8FKBOoV98Y/UyEQJucNThI/AAAAAAAAAXE/7w7I_3_hQqo/s1600/es.png) > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/7a2866d5-b294-46fc-ab3b-01c8048c45b7%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7a2866d5-b294-46fc-ab3b-01c8048c45b7%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/7a2866d5-b294-46fc-ab3b-01c8048c45b7%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/7a2866d5-b294-46fc-ab3b-01c8048c45b7%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCNDiOG\_8dq%2BBQS3MPGxoB8ZS3mg9VAJd2x%2BVMfV2vDOA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CALY%3DcQCNDiOG_8dq%2BBQS3MPGxoB8ZS3mg9VAJd2x%2BVMfV2vDOA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\ **Post date:** [March 13, 2014, 9:23am UTC](https://discuss.elastic.co/t/auto-created-spam-index/16342/3 "2014-03-13T09:23:04Z")
On 13 March 2014 05:15, Ivan Brusic [ivan@brusic.com](mailto:ivan@brusic.com) wrote: > That said, your Elasticsearch server is still accessible to anyone over > the internet. I Or somebody on your network is infected with a bot. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAPt3XKTVvE0pbeKE%3DW-XWW9v6gkT70c0E%2BmTo5-V3X2ue3ruvA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAPt3XKTVvE0pbeKE%3DW-XWW9v6gkT70c0E%2BmTo5-V3X2ue3ruvA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:43am UTC](https://discuss.elastic.co/t/auto-created-spam-index/16342/4 "2017-07-06T01:43:32Z")