# Cluster getting deleted automatically **URL:** \ **Category:** Elasticsearch\ **Created:** [January 19, 2017, 3:47pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184 "2017-01-19T15:47:01Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![tushar\_chevulkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_chevulkar/32/46270_2.png) [@tushar\_chevulkar](https://discuss.elastic.co/u/tushar_chevulkar)\ **Post date:** [January 19, 2017, 3:47pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/1 "2017-01-19T15:47:01Z")
I am facing a very strange problem. I am crawling some data and saving it form time to time but my nodes in the cluster are deleted automatically as i am saving. I checked log files it only had two lines in it ``` [2017-01-19 15:18:34,201][INFO][cluster.metadata] [Terror] [please_read] creating index, cause [api], templates [], shards [5]/[1], mappings [] [2017-01-19 15:18:34,372][INFO][cluster.routing.allocation] [Terror] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[please_read][0], [please_read][4], [please_read][4], [please_read][0]] ...]). ``` ---
**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\ **Post date:** [January 19, 2017, 3:49pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/2 "2017-01-19T15:49:18Z")
I think you have been hit by the same attack as [Ransom attack on Elasticsearch cluster?](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310) because your cluster is open on the internet. You should read that topic and also this one (including the linked blog posts): [Protect your data from ransom attacks](https://discuss.elastic.co/t/protect-your-data-from-ransom-attacks/72027) ---
**Author:** ![tushar\_chevulkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_chevulkar/32/46270_2.png) [@tushar\_chevulkar](https://discuss.elastic.co/u/tushar_chevulkar)\ **Post date:** [January 19, 2017, 3:52pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/3 "2017-01-19T15:52:44Z")
it deletes all the nodes randomly at anytime . is it possible that it might happen because of low server config ? as i am using 4gb of ram only and the crawling process includes insert and update of data in every 30 -40 min ---
**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\ **Post date:** [January 19, 2017, 3:55pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/4 "2017-01-19T15:55:11Z")
As I said you should read the topics I linked to and the blog posts they contain and you should reconfigured your Elasticsearch cluster so it is not accessible from the open internet ---
**Author:** ![tushar\_chevulkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_chevulkar/32/46270_2.png) [@tushar\_chevulkar](https://discuss.elastic.co/u/tushar_chevulkar)\ **Post date:** [January 19, 2017, 3:56pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/5 "2017-01-19T15:56:32Z")
Is it possible that it might happen because of low server config ? as i am using 4gb of ram only and the crawling process includes insert and update of data in every 30 -40 min ---
**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\ **Post date:** [January 19, 2017, 3:59pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/6 "2017-01-19T15:59:14Z")
Have you read the links I provided? They explain that this is a result of a malicious attack on your cluster. You need to read the links and follow their advice. ---
**Author:** ![tushar\_chevulkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_chevulkar/32/46270_2.png) [@tushar\_chevulkar](https://discuss.elastic.co/u/tushar_chevulkar)\ **Post date:** [January 19, 2017, 3:59pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/7 "2017-01-19T15:59:43Z")
okay thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 16, 2017, 4:00pm UTC](https://discuss.elastic.co/t/cluster-getting-deleted-automatically/72184/8 "2017-02-16T16:00:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.