# ElasticSearch Node Rebuilt - lost indices

**URL:** <https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507>\
**Category:** Elasticsearch\
**Created:** [April 24, 2025, 10:50pm UTC](https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507 "2025-04-24T22:50:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [April 24, 2025, 10:50pm UTC](https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507/1 "2025-04-24T22:50:54Z")

</div>

I had to rebuild a failing ES NODE and after I finished the re-indexing I can see that in the nodes folder there are several other indices that I didn't restore and I don't think are needed by anyone.

I don't think they have anything in the other indices but where would they have come from?  
ES standard install?  
Someone messed up and created them by accident?

Required Indices

```auto
$ curl -XGET http://10.8.36.119:9200/_cat/indices
green open us-d728411a 5 1 12802962 328190 44.3gb 22.1gb
green open us-d728411b 5 1 973523 55497 349.5mb 173.6mb

```

Basically I don't need almost of these, except for the two above.

```auto
# ls nodes/0/indices/
0 node
1 opennms
2 orders
3 pages
account password_change.cgi
adminer pcidss
adminer.php perl
ajax php-cgi
api rapi
app run
apply.cgi us-d728411a
apply_sec.cgi server
apps service
backend servlet
us-d728411b session
cgi-bin spcgi.cgi
clients spipe
confluence ssl-vpn
console struts2-rest-showcase
dana-na template
dologin.action templates
(download) user
fileupload user.action
fuel userportal
geoserver users
getcfg.php v1
goanywhere webconsole
index.php website
integration webtools
invoker webui
jars wiki
javax.faces.resource wls-wsat
jolokia wp-admin
json wp-json
lucee xmlrpc

```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 24, 2025, 11:18pm UTC](https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507/2 "2025-04-24T23:18:24Z")

</div>

Looks like you opened your cluster on internet without any protection. Did you?  
I also guess you are running a VERY old version, right?

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [April 24, 2025, 11:25pm UTC](https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507/3 "2025-04-24T23:25:47Z")

</div>

That stuff shouldn’t be there. Looks very fishy. Jolokia?

I’m not sure if you telling the whole story here? Rebuild? Failing, in what way?

When you start with fresh install, the data directory, and anything underneath should be empty. Only elasticsearch should be reading/writing there. Id be very concerned.

---

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [May 20, 2025, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507/4 "2025-05-20T20:51:47Z")

</div>

Thank you, we nuked the cluster and started again with a current release.