# Default index deleted

**URL:** <https://discuss.elastic.co/t/default-index-deleted/157791>\
**Category:** Kibana\
**Created:** [November 22, 2018, 1:37am UTC](https://discuss.elastic.co/t/default-index-deleted/157791 "2018-11-22T01:37:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuntun](https://avatars.discourse-cdn.com/v4/letter/y/8797f3/32.png) [@yuntun](https://discuss.elastic.co/u/yuntun)\
**Post date:** [November 22, 2018, 1:37am UTC](https://discuss.elastic.co/t/default-index-deleted/157791/1 "2018-11-22T01:37:06Z")

</div>

hi,all.Beginning last week, around 9:05 Beijing time every morning, the default index of kibana will be deleted automatically. Saturdays and Sundays are normal, and it will be deleted again from Monday morning. I have not set the deletion task myself.  
kibana version:5.6.7

This one will become null.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/686cfbaaa6c1d7633ada0eceeb9d0b3bb091dfbf.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b8c193754ebf1e4f6d8d748e47b1928e15fec09f.png)

I need to reset the default index every morning.  
I used cross cluster.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c7bb33ea5f6d487e2996c3a30662aa33ca0d763.png)

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [November 22, 2018, 12:43pm UTC](https://discuss.elastic.co/t/default-index-deleted/157791/2 "2018-11-22T12:43:38Z")

</div>

That sounds really weird. Can you try and set up some audit logs on the Elasticsearch cluster when before the reset happens? it can shed some light on what resets the index pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2018, 12:43pm UTC](https://discuss.elastic.co/t/default-index-deleted/157791/3 "2018-12-20T12:43:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.