ElasticSearch Node Rebuilt - lost indices

Elastic Stack Elasticsearch
1

I had to rebuild a failing ES NODE and after I finished the re-indexing I can see that in the nodes folder there are several other indices that I didn't restore and I don't think are needed by anyone.

I don't think they have anything in the other indices but where would they have come from?
ES standard install?
Someone messed up and created them by accident?

Required Indices

$ curl -XGET http://10.8.36.119:9200/_cat/indices
green open us-d728411a   5 1 12802962 328190  44.3gb  22.1gb
green open us-d728411b 5 1   973523  55497 349.5mb 173.6mb

Basically I don't need almost of these, except for the two above.

# ls nodes/0/indices/
0                                                         node
1                                                         opennms
2                                                         orders
3                                                         pages
account                                                   password_change.cgi
adminer                                                   pcidss
adminer.php                                               perl
ajax                                                      php-cgi
api                                                       rapi
app                                                       run
apply.cgi                                                 us-d728411a
apply_sec.cgi                                             server
apps                                                      service
backend                                                   servlet
us-d728411b                                               session
cgi-bin                                                   spcgi.cgi
clients                                                   spipe
confluence                                                ssl-vpn
console                                                   struts2-rest-showcase
dana-na                                                   template
dologin.action                                            templates
(download)                                                user
fileupload                                                user.action
fuel                                                      userportal
geoserver                                                 users
getcfg.php                                                v1
goanywhere                                                webconsole
index.php                                                 website
integration                                               webtools
invoker                                                   webui
jars                                                      wiki
javax.faces.resource                                      wls-wsat
jolokia                                                   wp-admin
json                                                      wp-json
lucee                                                     xmlrpc
2

Looks like you opened your cluster on internet without any protection. Did you?
I also guess you are running a VERY old version, right?

1 Like
3

That stuff shouldn’t be there. Looks very fishy. Jolokia?

I’m not sure if you telling the whole story here? Rebuild? Failing, in what way?

When you start with fresh install, the data directory, and anything underneath should be empty. Only elasticsearch should be reading/writing there. Id be very concerned.