# Elasticsearch deletes my index out of nowhere **URL:** \ **Category:** Elasticsearch\ **Created:** [April 19, 2021, 8:26am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551 "2021-04-19T08:26:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Nikolaj\_Karpov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolaj_karpov/32/78333_2.png) [@Nikolaj\_Karpov](https://discuss.elastic.co/u/Nikolaj_Karpov)\ **Post date:** [April 19, 2021, 8:26am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551/1 "2021-04-19T08:26:26Z")
I have `Elasticsearch` server on `AWS` . And every now and then my `Elasticsearch` index is being somehow deleted without me doing anything. Below are the logs from my `Elasticsearch` server. ```auto [2021-04-19T01:30:00,001][INFO][o.e.x.s.SnapshotRetentionTask] [ip-10-0-0-94] starting SLM retention snapshot cleanup task [2021-04-19T01:30:00,009][INFO][o.e.x.s.SnapshotRetentionTask] [ip-10-0-0-94] there are no repositories to fetch, SLM retention snapshot cleanup task complete [2021-04-19T02:27:00,000][INFO][o.e.x.m.MlDailyMaintenanceService] [ip-10-0-0-94] triggering scheduled [ML] maintenance tasks [2021-04-19T02:27:00,000][INFO][o.e.x.m.a.TransportDeleteExpiredDataAction] [ip-10-0-0-94] Deleting expired data [2021-04-19T02:27:00,002][INFO][o.e.x.m.j.r.UnusedStatsRemover] [ip-10-0-0-94] Successfully deleted [0] unused stats documents [2021-04-19T02:27:00,002][INFO][o.e.x.m.a.TransportDeleteExpiredDataAction] [ip-10-0-0-94] Completed deletion of expired ML data [2021-04-19T02:27:00,002][INFO][o.e.x.m.MlDailyMaintenanceService] [ip-10-0-0-94] Successfully completed [ML] maintenance task: triggerDeleteExpiredDataTask [2021-04-19T02:58:46,088][INFO][o.e.c.m.MetadataDeleteIndexService] [ip-10-0-0-94] [read__me/xc6mW05hTV-Xn1TTqX_FEA] deleting index [2021-04-19T02:58:46,641][INFO][o.e.c.m.MetadataDeleteIndexService] [ip-10-0-0-94] [superhero/PHe6S6kSRoSamCaaiPBSFg] deleting index [2021-04-19T02:58:47,212][INFO][o.e.c.m.MetadataCreateIndexService] [ip-10-0-0-94] [read__me] creating index, cause [api], templates [], shards [1]/[1] [2021-04-19T02:58:47,823][INFO][o.e.c.m.MetadataMappingService] [ip-10-0-0-94] [read__me/ODzWqR5FTeeiBhOBG-EMzA] create_mapping [_doc] [2021-04-19T07:17:10,800][INFO][o.e.c.m.MetadataCreateIndexService] [ip-10-0-0-94] [superhero] creating index, cause [api], templates [], shards [1]/[0] ``` My question is - how do I prevent Elasticsearch from deleting my index? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 19, 2021, 9:15am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551/2 "2021-04-19T09:15:43Z")
Welcome! Elasticsearch does not delete existing indices unless those are internals indices or that you have configured something. The only thing we can tell here: ``` [2021-04-19T02:58:46,088][INFO][o.e.c.m.MetadataDeleteIndexService] [ip-10-0-0-94] [read__me/xc6mW05hTV-Xn1TTqX_FEA] deleting index [2021-04-19T02:58:46,641][INFO][o.e.c.m.MetadataDeleteIndexService] [ip-10-0-0-94] [superhero/PHe6S6kSRoSamCaaiPBSFg] deleting index ``` Is that "something" called the Delete Index API at `2021-04-19T02:58:46` and removed indices `read__me` and `superhero`. Is there any chance that you exposed you elasticsearch cluster on internet? If not, are you running any other tool which can connect to Elasticsearch node? ---
**Author:** ![Nikolaj\_Karpov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolaj_karpov/32/78333_2.png) [@Nikolaj\_Karpov](https://discuss.elastic.co/u/Nikolaj_Karpov)\ **Post date:** [April 19, 2021, 9:25am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551/3 "2021-04-19T09:25:32Z")
Yes, both Elasticsearch and Kibana are exposed on the Internet. ---
**Author:** ![Nikolaj\_Karpov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolaj_karpov/32/78333_2.png) [@Nikolaj\_Karpov](https://discuss.elastic.co/u/Nikolaj_Karpov)\ **Post date:** [April 19, 2021, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551/4 "2021-04-19T09:48:05Z")
I just restricted access to Elasticsearch only from my home IP address and internal AWS network and I restricted access to Kibana only form my home IP address. Hopefully this helps and my index won't be deleted again. Thanks! ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 19, 2021, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551/5 "2021-04-19T10:14:32Z")
You should definitely read this. > **[Securing Elasticsearch: How to prevent an Elasticsearch server breach](https://www.elastic.co/blog/how-to-prevent-elasticsearch-server-breach-securing-elasticsearch)** > > Read about how data breaches come about and how users can best protect against them in the context of Elasticsearch. Learn how to secure your Elasticsearch clusters, so your data isn't part of an Elasticsearch server breach BTW did you look at [Cloud by Elastic](https://www.elastic.co/cloud), also available if needed from [AWS Marketplace](https://aws.amazon.com/marketplace/pp/Elasticsearch-Inc-Elasticsearch-Service-on-Elastic/B01N6YCISK), [Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/elastic.ec-azure?tab=Overview) and [Google Cloud Marketplace](https://console.cloud.google.com/marketplace/details/endpoints/elasticsearch-service.gcpmarketplace.elastic.co)? Cloud by elastic is one way to have access to **all features** , all managed by us. Think about what is there yet like Security, Monitoring, Reporting, SQL, Canvas, Maps UI, Alerting and built-in solutions named [Observability](https://www.elastic.co/observability), [Security](https://www.elastic.co/security), [Enterprise Search](https://www.elastic.co/enterprise-search) and what is coming next 🙂 ... ---
**Author:** ![Nikolaj\_Karpov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nikolaj_karpov/32/78333_2.png) [@Nikolaj\_Karpov](https://discuss.elastic.co/u/Nikolaj_Karpov)\ **Post date:** [April 19, 2021, 10:27am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551/6 "2021-04-19T10:27:18Z")
Thanks, I will definitely read this article! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 17, 2021, 10:28am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-my-index-out-of-nowhere/270551/7 "2021-05-17T10:28:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.