# Indices deleted as a result of unauthorised access – how to restore?

**URL:** <https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637>\
**Category:** Elasticsearch\
**Created:** [October 27, 2022, 6:23pm UTC](https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637 "2022-10-27T18:23:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Drept](https://avatars.discourse-cdn.com/v4/letter/d/ce7236/32.png) [@Drept](https://discuss.elastic.co/u/Drept)\
**Post date:** [October 27, 2022, 6:23pm UTC](https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637/1 "2022-10-27T18:23:19Z")

</div>

As a result of compromised security, my ES server was accessed by a third party that deleted all the indices. While I can easily recreate and repopulate my own indices, there are a few that I don't know how to deal with. Here is the data from my ES log:

> [.elastichq/uxLuaj6oS0ySf0ofXovsqw] deleting index  
> [.security-7/-SZSk\_LDQcq-b3DB9SL30g] deleting index  
> [service/Q-HEaeMGTxabmotQ2OJrOw] deleting index  
> [api/Av2IvqEeRxaMt2mSRtCVXQ] deleting index

Could you explain whether the lack of these indices affects the operation of my ES and what I should do in these conditions?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 28, 2022, 4:09am UTC](https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637/2 "2022-10-28T04:09:27Z")

</div>

From this list only the `.security-7` index is a system indice, it is where the information about the built-in users are stored.

If this is index is deleted I think you will need to recreate your users and passwords.

The other indices are not part of the stack and are custom indices created by someone or some tool with access to your cluster.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 31, 2022, 1:41am UTC](https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637/3 "2022-10-31T01:41:23Z")

</div>

Do you have a snapshot of your data?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2022, 1:41am UTC](https://discuss.elastic.co/t/indices-deleted-as-a-result-of-unauthorised-access-how-to-restore/317637/4 "2022-11-28T01:41:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.