Elastic Search index getting automatically deleted

[Arkapravo_Das]

Hi All,
I am a newbie into this..working in a clustered environment where two nodes are configured as

cluster.name:
node.master: true
node.data: true
discovery.zen.ping.multicast.enabled: false
discovery.zen.ping.unicast.hosts: <1st node>
** config is same for both the servers.

Scenario: One index got created [which we have seen in elastic search head] and then after few minutes it got deleted automatically.There is no deletion job configured though.

Can you please advice me what can be the possible scenarios?Server version is 0.x

[warkolm (Mark Walkom)]

@Arkapravo_Das

I am a newbie into this

Welcome!

@Arkapravo_Das

two nodes

That's not ideal, check out Important Configuration Changes | Elasticsearch: The Definitive Guide [2.x] | Elastic for more.

@Arkapravo_Das

Server version is 0.x

Do you mean the Elasticsearch version? Can you show the output of curl HOST:9200?

[Arkapravo_Das]

While describing the config: I dint mention the cluster name.Actually it is not blank, for both the servers it is same.

I Used elastic search head to get the output instead of curl.

http://HOST1:9200/
{
"ok": true,
"status": 200,
"name": "ES_SERVER1”,
"version": {
"number": "0.20.1",
"snapshot_build": false
},
"tagline": "You Know, for Search"
}

http://HOST2:9200/
{
"ok": true,
"status": 200,
"name": "ES_SERVER2”,
"version": {
"number": "0.20.1",
"snapshot_build": false
},
"tagline": "You Know, for Search"
}

[warkolm (Mark Walkom)]

@Arkapravo_Das

"number": "0.20.1",

Is there any reason you are using such an old version? Can you upgrade?

[dadoonet (David Pilato)]

@Arkapravo_Das

Scenario: One index got created [which we have seen in Elasticsearch head] and then after few minutes it got deleted automatically.There is no deletion job configured though.

Something or someone is doing that most likely unless you see something weird in your logs.
May be you have your cluster exposed without any protection on internet or in your company and someone is removing indices? May be you have something wrong in your code? May be you are using the default cluster name and someone in your company just started another node locally which joins accidentally the cluster and he ran DELETE /?

Lot of options there. In all cases, as @warkolm said, you really need to install a new version.