# Elasticsearch indices gets deleted automatically periodically

**URL:** <https://discuss.elastic.co/t/elasticsearch-indices-gets-deleted-automatically-periodically/71585>\
**Category:** Elasticsearch\
**Created:** [January 13, 2017, 11:41pm UTC](https://discuss.elastic.co/t/elasticsearch-indices-gets-deleted-automatically-periodically/71585 "2017-01-13T23:41:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Srinivasan\_Ramaswamy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srinivasan_ramaswamy/32/74106_2.png) [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\
**Post date:** [January 13, 2017, 11:41pm UTC](https://discuss.elastic.co/t/elasticsearch-indices-gets-deleted-automatically-periodically/71585/1 "2017-01-13T23:41:34Z")

</div>

I have set up a demo elasticsearch cluster (with 3 nodes) in ec2 to build a prototype. I run an indexer job on demand to populate documents into the index. I am querying the index using sense plugin and a basic javascript UI.

For the last couple of days all the indices in my cluster gets wiped out completely around noon time. I checked multiple times, i dont have any delete all command (or any delete command) any where in my code or sense plugin. I suspected the ec2 instance got rebooted, but "Launch time" still shows the time when i originally launched the cluster. Moreover all the elasticsearch log files are there. So far, It doesnt look like a ec2 issue. I also checked for the list of plugins and i only have cloud-aws installed.

I enabled debug logging last time it occurred and this is what i see in the logs now during the time in occurred

node-1  
[2017-01-13 19:58:34,640][DEBUG][cluster.service] [Blue Diamond] processing [delete-index [command.php, index-1, index-2, warning]]: execute

Does it ring a bell to anyone ? This has happened consecutively for the last 3 days around the same time. does it ring a bell to anyone ? Any tips would be appreciated.

I did not set action.destructive\_requires\_name: true as it was not a production cluster. Now I am going to set it and see if that prevents.

Note: I am using elasticsearch version 2.4.3

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 13, 2017, 11:46pm UTC](https://discuss.elastic.co/t/elasticsearch-indices-gets-deleted-automatically-periodically/71585/2 "2017-01-13T23:46:45Z")

</div>

Is your cluster accessible via the internet?

---

<div class="post-metadata">

**Author:** ![Srinivasan\_Ramaswamy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srinivasan_ramaswamy/32/74106_2.png) [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\
**Post date:** [January 17, 2017, 8:16pm UTC](https://discuss.elastic.co/t/elasticsearch-indices-gets-deleted-automatically-periodically/71585/3 "2017-01-17T20:16:00Z")

</div>

apparently it was accessible and some random guy was deleting it. today i saw an index created please\_read with the content

"\_source": {  
"Info": "Your DB is Backed up at our servers, to restore send 0.5 BTC to the Bitcoin Address then send an email with your server ip",  
"Bitcoin Address": "12JNfaS2Gzic2vqzGMvDEo38MQSX1kDQrx",  
"Email": "elasticsearch@mail2tor.com"  
}

All the data that i work with are publicly available in the internet, so i am not too worried. but lesson learned.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2017, 8:16pm UTC](https://discuss.elastic.co/t/elasticsearch-indices-gets-deleted-automatically-periodically/71585/4 "2017-02-14T20:16:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.