# Indices keep getting deleted automatically

**URL:** <https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [April 28, 2022, 9:00pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555 "2022-04-28T21:00:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 28, 2022, 9:00pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555/1 "2022-04-28T21:00:04Z")

</div>

We are running ELK 7.6.2 stack.

It seems that indices are getting deleted / cleaned automatically by ES.

We have ILM policy of 2 days retention for the index, but somehow it deletes the current one too.

After enabling debug in both Logstash and ES, the following was seen:

```auto
[2022-04-28T16:39:22,027][DEBUG][o.e.i.c.IndicesClusterStateService] [xx-xxx-xxx] [[prd_tv_global_2022.04.22/wewfo9p-TV6wK9fuLZf7ig]] cleaning index, no longer part of the metadata

```

```auto
[2022-04-28T16:39:22,355][DEBUG][o.e.i.c.IndicesClusterStateService] [xx-xxx-xxx] [[prd_tv_global_2022.04.25/Hp-K_6r6SSqPMayCGWsi1w]] cleaning index, no longer part of the metadata

```

Note todays' timestamp of April 28:

```auto
[2022-04-28T16:39:22,425][DEBUG][o.e.i.c.IndicesClusterStateService] [xx-xxx-xxx] [[prd_tv_global_2022.04.28/uYbaWQDgTwiDgrGOgIvcJA]] cleaning index, no longer part of the metadata

```

stdout was enabled in the Logstash config and messages could be seen coming into Logstash but index is not getting created.

```auto
output {
 file {
   path => "/opt/gtal/ptal/elasticsearch/logs/Logstash/global_rubydebug.txt"
   codec => rubydebug
 }

```

Please guide. Please note that I took out the index (in question) from index template too.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 28, 2022, 10:13pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555/2 "2022-04-28T22:13:43Z")

</div>

> [@zaeemmasood](#):
>
> We have ILM policy of 2 days retention for the index, but somehow it deletes the current one too.

It'd be useful if you could show us the policy.

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 28, 2022, 10:42pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555/3 "2022-04-28T22:42:13Z")

</div>

```auto
{
  "cleanup-crnlp" : {
    "version" : 1,
    "modified_date" : "2021-03-02T20:05:41.551Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : { }
        },
        "delete" : {
          "min_age" : "2d",
          "actions" : {
            "delete" : { }
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [April 28, 2022, 10:45pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555/4 "2022-04-28T22:45:37Z")

</div>

The related index was part of the "2days\_crnlp\_template" and I took it out today just to be sure.

```auto
GET _cat/templates/2days_crnlp_template

```

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [May 3, 2022, 9:07pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555/5 "2022-05-03T21:07:30Z")

</div>

Hi @warkolm. Removed the entire template just to be sure but somehow index is not getting created. The Logstash debug shows messages coming in at a very very fast pace.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2022, 9:08pm UTC](https://discuss.elastic.co/t/indices-keep-getting-deleted-automatically/303555/6 "2022-05-31T21:08:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.