# Indices all gone but i don't think i did it

**URL:** <https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370>\
**Category:** Elasticsearch\
**Created:** [January 12, 2017, 12:25pm UTC](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370 "2017-01-12T12:25:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![switchedfabric](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/switchedfabric/32/14508_2.png) [@switchedfabric](https://discuss.elastic.co/u/switchedfabric)\
**Post date:** [January 12, 2017, 12:25pm UTC](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370/1 "2017-01-12T12:25:50Z")

</div>

Hi all,

I've been running ES 5 for some time (say a month) now and all has been well, but last night all my indices were deleted. I see this in the log (the second line):

---- 8\< ----  
[2017-01-11T21:23:04,357][WARN][o.e.d.z.p.PublishClusterStateAction] [master] timed out waiting for all nodes to process published state ...  
[2017-01-11T21:23:08,473][WARN][o.e.c.s.ClusterService] [master] cluster state update task [delete-index ...] took [34.1s] above the warn threshold of 30s  
---- 8\< ----

Thing is, i didn't do it on purpose, and i can't think anyone else did it maliciously. What could i have done wrong?

It's an 8 node cluster:  
---- 8\< ----  
$ curl -X GET localhost:9200/\_cat/nodes  
10.6.204.38 55 99 21 1.24 1.83 1.99 di - data-ip-10-6-204-38  
10.6.204.47 69 97 99 12.72 11.79 11.40 di - data-ip-10-6-204-47  
10.6.204.6 42 99 99 10.36 10.62 10.63 di - data-ip-10-6-204-6  
10.6.204.46 63 94 99 9.89 10.96 10.77 di - data-ip-10-6-204-46  
10.6.204.43 57 99 22 1.98 2.28 2.37 di - data-ip-10-6-204-43  
10.6.204.33 24 99 99 15.38 12.45 11.71 di - data-ip-10-6-204-33  
10.6.204.58 25 81 76 6.46 6.76 6.86 mdi \* master  
10.6.204.44 65 99 22 3.02 2.35 2.11 di - data-ip-10-6-204-44  
---- 8\< ----

Version info:  
---- 8\< ----  
[master] version[5.0.1], pid[27750], build[080bb47/2016-11-11T22:08:49.812Z], OS[Linux/3.13.0-74-generic/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/1.8.0\_91/25.91-b14]  
---- 8\< ----

Port 9200 is open to the internet. Might it be malicious?

Thanks!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 12, 2017, 5:35pm UTC](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370/2 "2017-01-12T17:35:02Z")

</div>

See this thread:

> [@Ransom attack on Elasticsearch cluster?](https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310):
>
> Today I found that all indices on our Test ES cluster was removed and one new index "warning" was created there. And I found following text from the raw index data: SEND 0.2 BTC TO THIS WALLET: 1DAsGY4Kt1a4LCTPMH5vm5PqX32eZmot4r IF YOU WANT RECOVER YOUR DATABASE! SEND TO THIS EMAIL YOUR SERVER IP AFTER SENDING THE BITCOINS... It is a tipical ransom attack on MongoDB recently: [https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-f…](https://www.bleepingcomputer.com/news/security/number-of-hijacked-mongodb-databases-is-going-up-as-more-hackers-are-flocking-in/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2017, 5:35pm UTC](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370/3 "2017-02-09T17:35:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.