Clear cache not working properly

[hack3rcon (Jason)]

Hello.
I did below command my ELK box for clear cache:

# curl -XDELETE 'http://localhost:9200/_all'
{"acknowledged":true}

but when I restart my server then cache back:

# curl -XGET 'http://localhost:9200/_cat/indices?v'
health status index                 uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   .kibana               tPXxYJTKSnqcIcII24wi5g   1   1          1            0      3.1kb          3.1kb
yellow open   index_name-2017.08.26 UaZplhq-TjiZYAKRMiaIeg   5   1          3            0     18.9kb         18.9kb
yellow open   beat-2017.08.26       3WoFB9mlTqeSh8Puud-rEw   5   1          3            0     18.8kb         18.8kb

I have not any active server that send logs to my ELK but I don't know why cache back!!!

Any idea to solve it?

Thank you.

[warkolm (Mark Walkom)]

Those are not caches, they are indices.

The Kibana one will be created as soon as you start Kibana. The others would be because you are sending data to Elasticsearch someone.

[hack3rcon (Jason)]

As I said, All server are OFF and I have not data stream!!!
How can I clear "Kibana" indices?

[warkolm (Mark Walkom)]

There is something still sending to Elasticsearch, it will not create these indices by itself.

[hack3rcon (Jason)]

OK, Let me to show you that I have not any data stream:

# tcpdump -n -s 0 -i enp4s0 -X tcp port 9200 and host 172.30.10.17
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp4s0, link-type EN10MB (Ethernet), capture size 65535 bytes

# curl -XGET 'http://localhost:9200/_cat/indices?v'
health status index                 uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   beat-2017.08.26       bb342tKBRreMvEcwenki0A   5   1          3            0     26.3kb         26.3kb
yellow open   .kibana               lenrD9HkRDOe7OcmCtNWeg   1   1          1            0      3.1kb          3.1kb
yellow open   index_name-2017.08.26 ZMxwlq0iRMeJRnKG9KhQ3g   5   1          3            0     18.9kb         18.9kb

and:

Why no result?