# Elasticsearch Index Completely Missing
**URL:** https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640
**Category:** Elasticsearch
**Created:** [July 19, 2018, 12:48am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640 "2018-07-19T00:48:20Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@hacker\_21](https://discuss.elastic.co/u/hacker_21)
#### Post date: [July 19, 2018, 12:48am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/1 "2018-07-19T00:48:21Z")
Hey there,
I've had an elasticsearch cluster running since late June. My search wasn't working today and when I looked at the app I was getting this error:
`elasticsearch.exceptions.NotFoundError: TransportError(404, 'index_not_found_exception', 'no such index')`
When I went to Kibana, other than saying my license had expired (for x-pack, monitoring, etc) ... there was no messages. It was asking me to create a new index because it couldn't find any ... the only one it found was for an index called README.
When I ran LSBLK, I could see the drives were still mounted but only had 194 MB of data (used to be close to 300-500gb). All 3 nodes don't have their data anymore. It's just gone.
When I looked at the server's keyboard commands nothing unusual and the login activity shows it was only me. Does anyone have any idea how I can find out where the data went or how I can recover it?
I looked at the cluster health and it shows that there are 3 unassigned shards ... but with all 3 nodes online and with empty hard drives where could they be? I have always had automatic shard allocation enabled.
... There has been NO data recently indexed and I'm sure no one our end deleted the index or altered it any way ... we definitely didn't accidentally delete the index from the command line. There have only been queries to the index using the python elasticsearch client.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 19, 2018, 1:00am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/2 "2018-07-19T01:00:57Z")
I don't suppose this cluster is exposed, unprotected, to the internet is it?
---
### Author:  [@hacker\_21](https://discuss.elastic.co/u/hacker_21)
#### Post date: [July 19, 2018, 1:02am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/3 "2018-07-19T01:02:07Z")
we have been running x-pack from the beginning and have never shared our endpoints publicly or our ES logins.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 19, 2018, 1:02am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/4 "2018-07-19T01:02:43Z")
> [@hacker\_21](#):
>
> we have been running x-pack
What license level though?
---
### Author:  [@hacker\_21](https://discuss.elastic.co/u/hacker_21)
#### Post date: [July 19, 2018, 1:04am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/5 "2018-07-19T01:04:50Z")
we're running es 6.3.0
our trial just expired 2-3 days ago I believe ... so we do not have a license (?) not sure what you mean by license level
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 19, 2018, 1:06am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/6 "2018-07-19T01:06:35Z")
There's a few levels - [https://www.elastic.co/subscriptions](https://www.elastic.co/subscriptions)
If you were running a basic license, then that doesn't include Security. And based on that `README` index you mentioned, someone has probably found your cluster while browsing on the internet, deleted all your indices, and then tried to ransom you for the backups.
---
### Author:  [@hacker\_21](https://discuss.elastic.co/u/hacker_21)
#### Post date: [July 19, 2018, 1:10am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/7 "2018-07-19T01:10:12Z")
so the ES, Kibana, and other passwords initially generated when we were creating the index were not real? The ES server was exposed the whole time?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 19, 2018, 1:12am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/8 "2018-07-19T01:12:03Z")
I can't comment on that as I don't know what you did.
But, again, based on that index that does exist it seems my explanation is a possible outcome as we've seen similar things in the past. I would suggest you look in that index, there may a document in there with more info.
---
### Author:  [@Johnnycc1](https://discuss.elastic.co/u/Johnnycc1)
#### Post date: [July 19, 2018, 1:15am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/9 "2018-07-19T01:15:48Z")
So if you are using xpack with basic username and password setup. And your licence expiries what happens?
---
### Author:  [@hacker\_21](https://discuss.elastic.co/u/hacker_21)
#### Post date: [July 19, 2018, 1:16am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/10 "2018-07-19T01:16:40Z")
you're right, inside of the index is this message:
| t \_id | | 1 |
| --- | --- | --- |
| t \_index | | readme |
| # \_score | | 1 |
| t \_type | | howtogetmydataback |
| t btc | | ALL YOUR INDEX AND ELASTICSEARCH DATA HAVE BEEN BACKED UP AT OUR SERVERS, TO RESTORE SEND 0.1 BTC TO THIS BITCOIN ADDRESS \*\*\*\*\*\*\*\* THEN SEND AN EMAIL WITH YOUR SERVER IP, DO NOT WORRY, WE CAN NEGOCIATE IF CAN NOT PAY |
| t mail | | \*\*\*\*\*\*\*\* |
| t note | | \*\*\*\*\*\* |
but what I don't understand is how come we had to connect to ES with a password? How come we had Elasticsearch, Kibana, and Logstash accounts created? How come we had to login to the Kibana panel too? If we didn't have x-pack security the whole time?
here's how we originally generated the logins:
sudo /usr/share/elasticsearch/bin/x-pack/setup-passwords auto
I believe our version of ES was updated a week after we created the index ... this new version automatically included x-pack but we were still using the generated logins to access Elasticsearch data/Kibana
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 19, 2018, 6:40am UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/11 "2018-07-19T06:40:06Z")
Do you mind if we reach out to you directly to discuss this further?
---
### Author:  [@hacker\_21](https://discuss.elastic.co/u/hacker_21)
#### Post date: [July 19, 2018, 12:58pm UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/12 "2018-07-19T12:58:30Z")
yes please
---
### Author:  [@Abderrahim\_Slim](https://discuss.elastic.co/u/Abderrahim_Slim)
#### Post date: [July 20, 2018, 3:37pm UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/14 "2018-07-20T15:37:21Z")
Can you please tell us how it ends ? how they did ? It's interessting to know the technics they used and trying to secure/avoid them.
---
### Author:  [@maziyar](https://discuss.elastic.co/u/maziyar)
#### Post date: [July 22, 2018, 4:34pm UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/15 "2018-07-22T16:34:34Z")
I know this won't help to protect the privacy of your data when ES is open to the internet as intruders can still read, but it is highly advised to set this setting to true to make it as hard as possible to delete the entire cluster at least not by one command:
> In order to disable allowing to delete indices via wildcards or \_all, set action.destructive\_requires\_name setting in the config to true. This setting can also be changed via the cluster update settings API.
You can (should) restrict `DELETE` from your reverse proxy (Nginx or Apache) as well.
Also, I think the Trial products are best to be tested in a development setup where the rollback on expired products is more manageable than in a production.
I hope you have made some snapshots.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 19, 2018, 4:34pm UTC](https://discuss.elastic.co/t/elasticsearch-index-completely-missing/140640/16 "2018-08-19T16:34:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.