How to monitor cause of deletion of documents in index?

Elastic Stack Elasticsearch
1

Dears,

Is there any way to monitor process of deletion of documents from index?
I'm asking about it because of from few days I observed this odd behavior. Similar situation I had when doc id was the same for few documents. I wonder what the cause is this time. Any idea?

Best Regards,
Dan

2

Elasticsearch doesn't delete docs, unless you are on an old version and using TTL.
Otherwise something is telling Elasticsearch to delete them.

Do you have access control on your cluster?

3

@warkolm
Yes, I have access control on my cluster.

4

In my infrastructure few filebeats send applications logs to ELK, users have access to Kibana to see the logs with read only rights.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.