# Index patterns keep disappearing

**URL:** <https://discuss.elastic.co/t/index-patterns-keep-disappearing/249965>\
**Category:** Kibana\
**Created:** [September 25, 2020, 10:55am UTC](https://discuss.elastic.co/t/index-patterns-keep-disappearing/249965 "2020-09-25T10:55:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mutt13y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mutt13y/32/74962_2.png) [@mutt13y](https://discuss.elastic.co/u/mutt13y)\
**Post date:** [September 25, 2020, 10:55am UTC](https://discuss.elastic.co/t/index-patterns-keep-disappearing/249965/1 "2020-09-25T10:55:22Z")

</div>

Hi I was experiencing this issue, I see it has been reported previously.

> [@Kibana's default index pattern get deleted automatically](https://discuss.elastic.co/t/kibanas-default-index-pattern-get-deleted-automatically/189577):
>
> Hi, Kibana 6.7.1 I started to face a weird behavior with Kibana, for an unknown reason when logging in to Kibana it complains that there's no default index-pattern configured I then chose one of the index-pattern from the list and set it as the default, a few minutes later (less than an hour usually), the default index-pattern disappear again. Looking at the Kibana's setting API (/api/kibana/settings) gives this: With default index-pattern in place: {"settings":{"buildNum":{"userValue":202…

As it seems there were no solutions I though I would post my findings.  
I determined that the cause was that I had defined a catchall index-template with a lifecycle policy.  
The idea was to only keep any unknown index names for 3 days.  
This worked fine until we upgraded. I am guessing that .kibana index was recreated and then had the lifecycle policy applied.

there is no warning when creating a '\*' index template. IMO this should not apply to system indices.

I raised a bug with elastic

> <https://github.com/elastic/elasticsearch/issues/62891>
>
> \<!--
> GitHub is reserved for bug reports and feature requests; it is not the pla…ce
> for general questions. If you have a question or an unconfirmed bug , please
> visit the \[forums\](https://discuss.elastic.co/c/elasticsearch). Please also
> check your OS is \[supported\](https://www.elastic.co/support/matrix#show\_os).
> If it is not, the issue is likely to be closed.
> 
> For security vulnerabilities please only send reports to security@elastic.co.
> See https://www.elastic.co/community/security for more information.
> 
> Please fill in the following details to help us reproduce the bug:
> \--\>
> 
> \*\*Elasticsearch version\*\* (\`bin/elasticsearch --version\`):
> 7.9.1
> \*\*Plugins installed\*\*: \[\]
> 
> \*\*JVM version\*\* (\`java -version\`):
> openjdk version “14.0.1” 2020-04-14
> OpenJDK Runtime Environment AdoptOpenJDK (build 14.0.1+7)
> OpenJDK 64-Bit Server VM AdoptOpenJDK (build 14.0.1+7, mixed mode, sharing)
> 
> \*\*OS version\*\* (\`uname -a\` if on a Unix-like system):
> Centos7
> 3.10.0-957.27.2.el7.x86\_6
> 
> \*\*Description of the problem including expected versus actual behavior\*\*:
> Default index template with lifecycle policy applies to system indices
> 
> \*\*Steps to reproduce\*\*:
> 1. Create lifecycle policy with delete after N days
> 2. Create index template to apply lifecycle and match '\\\*'
> 3. In reality perform some upgrade which creates a new system index, to test delete .kibana
> 
> now the new lifecycle policy is applied to .kibana and settings will be lost every N days
> 
> This is a latent issue since most system indices will be created before the template in normal operation but after an upgrade the index can be replaced and so the policy is applied.
> 
> I think that '\\\*' should not match indices that start with a '.' we should have to explicitly use '.\\\*' or have a flag to indicate if it applies to system indices.
> 
> Certianly from an end user perspective there seems to be nothing obviously wrong with defining a catchall template with an aggressive lifecycle policy
> !\[Screenshot 2020-09-24 at 16 14 20\](https://user-images.githubusercontent.com/39803837/94171776-957a0d00-fe89-11ea-8f6e-2aa05252bb12.png)
> !\[Screenshot 2020-09-24 at 17 13 20\](https://user-images.githubusercontent.com/39803837/94171804-9ca11b00-fe89-11ea-854a-ec599b2e0a06.png)
> 
> 
> P.S.
> Work around is to create a policy matching ".\\\*" with a lower priority

I am only mentioning it here in case others experiance the same issue.

I resolved it by creating a template to match ".\*" with no life cycle and a very low priority.

---

<div class="post-metadata">

**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\
**Post date:** [September 28, 2020, 10:15am UTC](https://discuss.elastic.co/t/index-patterns-keep-disappearing/249965/2 "2020-09-28T10:15:49Z")

</div>

Thanks for sharing your finding @mutt13y!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2020, 10:16am UTC](https://discuss.elastic.co/t/index-patterns-keep-disappearing/249965/3 "2020-10-26T10:16:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.