Elasticsearch auto delete my data

Elastic Stack Elasticsearch
1

Hi everyone!
I'm having a problem that after a while, the elastic automatically deletes all the data even though I didn't configure anything to automatically delete, this is the log. Is there a way to disable the elastic auto-delete function?

[2020-11-28T08:30:00,091][INFO ][o.e.x.s.SnapshotRetentionTask] [PL.local] starting SLM retention snapshot cleanup task
[2020-11-28T08:30:00,091][INFO ][o.e.x.s.SnapshotRetentionTask] [PL.local] there are no repositories to fetch, SLM retention snapshot cleanup task complete
[2020-11-28T21:38:59,347][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [.apm-agent-configuration/PLThIEHAQnWvYzkwWJoCJg] deleting index
[2020-11-28T21:39:00,047][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [.apm-custom-link/bsNcZur0Tpmg6NXz2Y6r9A] deleting index
[2020-11-28T21:39:01,020][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [customers/GRKqtbtrQU--LrKVgDOj8w] deleting index
[2020-11-28T21:39:01,958][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [orders/Ocrp9cFcTGypx4TMjblQSA] deleting index
[2020-11-28T21:39:02,917][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [products/RwT_i07hSzyM-39xVlk-Rg] deleting index
[2020-11-28T21:39:03,998][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [providers/_dFezzhVTLOtdreERYKztA] deleting index
[2020-11-28T21:39:04,988][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [read_me/rgCeHzSHSi6hajs0Y-tmfQ] deleting index
[2020-11-28T21:39:06,246][INFO ][o.e.c.m.MetadataCreateIndexService] [PL.local] [read_me] creating index, cause [api], templates [], shards [1]/[1]
[2020-11-28T21:39:07,343][INFO ][o.e.c.m.MetadataMappingService] [PL.local] [read_me/OcYRZMHFROiAbP3FlYEwsw] create_mapping [_doc]
[2020-11-28T22:41:56,266][INFO ][o.e.c.m.MetadataDeleteIndexService] [PL.local] [read_me/OcYRZMHFROiAbP3FlYEwsw] deleting index
[2020-11-28T22:41:56,917][INFO ][o.e.c.m.MetadataCreateIndexService] [PL.local] [read_me] creating index, cause [api], templates [], shards [1]/[1]
[2020-11-28T22:41:58,156][INFO ][o.e.c.m.MetadataMappingService] [PL.local] [read_me/h_mbxNt1TG2pQ3VIb2B5oA] create_mapping [_doc]
2

Please don't post images of text as they are hard to read, may not display correctly for everyone, and are not searchable.

Instead, paste the text and format it with </> icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer.

It would be great if you could update your post to solve this.

I don't see any index removed by elastic here. What has been deleted?

1 Like
3

Elasticsearch does not automatically delete any data (possibly with the exception of some internal system and monitoring data). As your cluster does not appear to be secured it might be open to external attacks if it is exposed to the internet.

1 Like
4

thanks ! I will edit my post.

5

thanks ! I will check again for the security of the system.

6

When you say “deletes all the data” do you literally mean all your data, or just ML job results?

If it’s just ML job results you’re complaining about then there are some configurations you need to change.

1 Like
7

To me that indicates that you have your cluster open to the internet and not secured. Someone has then found this unsecured cluster and is deleting your data.

Take a look at the indicated read_me index.

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.