# Elasticsearch documents deleted automatically **URL:** \ **Category:** Elasticsearch\ **Created:** [August 20, 2016, 10:20am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505 "2016-08-20T10:20:29Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Selvam\_ayyanar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selvam_ayyanar/32/11101_2.png) [@Selvam\_ayyanar](https://discuss.elastic.co/u/Selvam_ayyanar)\ **Post date:** [August 20, 2016, 10:20am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/1 "2016-08-20T10:20:29Z")
Hi Team, In our production servers, documents are missing **particular type and particular shard**. same type other shard data available. no shard relocation, no node / cluster restart happen at the time. even no log messages printed on that time. Any clue on this? what i need to do now, please advice. ---
**Author:** ![Selvam\_ayyanar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selvam_ayyanar/32/11101_2.png) [@Selvam\_ayyanar](https://discuss.elastic.co/u/Selvam_ayyanar)\ **Post date:** [August 20, 2016, 10:33am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/2 "2016-08-20T10:33:03Z")
i see here deleted documents increased, and number of documents reduced in a particular time. nearly 1 lack documents deleted. we sure there isno manual delete happen, through api or from application layer. below the graphs shows deleted count and document count ( happen at 15:34:12 ) ![](https://us1.discourse-cdn.com/elastic/original/2X/4/4734b061598c95c36cbf3f3add0b0373286a7564.jpg) ![](https://us1.discourse-cdn.com/elastic/original/2X/6/67aa9b0e7a474f199596d4ad0959f4c864e0e5c6.jpg) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 20, 2016, 10:41am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/3 "2016-08-20T10:41:38Z")
ES will only delete documents if 1. Something makes a delete request 2. Something updates an existing document ---
**Author:** ![Selvam\_ayyanar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selvam_ayyanar/32/11101_2.png) [@Selvam\_ayyanar](https://discuss.elastic.co/u/Selvam_ayyanar)\ **Post date:** [August 20, 2016, 10:51am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/4 "2016-08-20T10:51:51Z")
HI warkolm, thanks for reply, We verified our server logs , history and application logs there is NO MANUAL deletion, is there any option to check how the documents are deleted ( i.e through api or from app layer ) let me know which logs help for me. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 20, 2016, 10:53am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/5 "2016-08-20T10:53:12Z")
The only way would be if you have a proxy that catches all the requests, or something like Shield that does audit logging. ---
**Author:** ![Selvam\_ayyanar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selvam_ayyanar/32/11101_2.png) [@Selvam\_ayyanar](https://discuss.elastic.co/u/Selvam_ayyanar)\ **Post date:** [August 20, 2016, 10:57am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/6 "2016-08-20T10:57:40Z")
ok, we are using 1.3.7 version is there any mapping conflict can cause this issue, i see mapping conflicts on that index. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 20, 2016, 10:58am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/7 "2016-08-20T10:58:01Z")
That's a _really_ old version, you should upgrade immediately. ---
**Author:** ![Selvam\_ayyanar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selvam_ayyanar/32/11101_2.png) [@Selvam\_ayyanar](https://discuss.elastic.co/u/Selvam_ayyanar)\ **Post date:** [August 20, 2016, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/8 "2016-08-20T11:01:48Z")
> [@Selvam\_ayyanar](#): > > is there any mapping conflict can cause this issue, i see mapping conflicts on that index. is there any mapping conflict can cause this issue, i see mapping conflicts on that index. ---
**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\ **Post date:** [August 20, 2016, 11:08am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/9 "2016-08-20T11:08:03Z")
\_ttl will also delete documents but you have to turn it on and you probably didn't. I expect there are some log levels you can crank up to get all the deleted documents to be logged but I'd have to look around to figure out what they are and I'm not in a place I can do that. Thatd only tell you about the next delete, it'd probably tell you about every index too, and I doubt it'd tell you _why_ the delete happened, just that it happened. Beyond that I don't know what to say. ---
**Author:** ![Selvam\_ayyanar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selvam_ayyanar/32/11101_2.png) [@Selvam\_ayyanar](https://discuss.elastic.co/u/Selvam_ayyanar)\ **Post date:** [August 22, 2016, 6:56am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/10 "2016-08-22T06:56:47Z")
we don't have \_ttl , i don't know why that **particular type in a particular shard data missing** , it occurs on another cluster also. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 22, 2016, 6:58am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/11 "2016-08-22T06:58:44Z")
Then something is deleting them. ---
**Author:** ![Selvam\_ayyanar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selvam_ayyanar/32/11101_2.png) [@Selvam\_ayyanar](https://discuss.elastic.co/u/Selvam_ayyanar)\ **Post date:** [August 29, 2016, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/12 "2016-08-29T07:18:17Z")
Hi @warkolm @nik9000 Many more thanks, we identified the issue in our app level. But we need to setup the query logging ( search, delete, index ). we are working on that. Again Thanks lot. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:24pm UTC](https://discuss.elastic.co/t/elasticsearch-documents-deleted-automatically/58505/13 "2017-07-05T22:24:31Z")