# Kibana data suddenly got missing! **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 4, 2020, 9:32am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943 "2020-05-04T09:32:14Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 4, 2020, 9:32am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/1 "2020-05-04T09:32:15Z")
Today morning when I've tried to open my Kibana, I found the following error in my browser. ![MicrosoftTeams-image (2)](https://us1.discourse-cdn.com/elastic/original/3X/8/2/829a471aa6648061fdd7c45816ac12b495010463.png) Then I've restarted Kibana. But after the restart, all of my indexes have been gone. ![MicrosoftTeams-image (1)](https://us1.discourse-cdn.com/elastic/original/3X/4/4/44ecc1a218a5e6162c2b8113c3f70c4faa8e3f6c.png) After that, to view all my works such that dashboards, visuals, I've imported my Saved Object backup file that is in json format. After imported, I found all the visuals and dashboards are there as it is but I've lost past data from elasticsearch. I found data only from yesterday's 00:00 hour to the current date-time. Why this type of sudden data loss has happened? Can I somehow track the incident from a log or somewhere? I've read a few posts in the elastic blog that refer to the same kind of issue. Is that that a security threat? Please help guys!! ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 4, 2020, 9:37am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/2 "2020-05-04T09:37:08Z")
Could you share your full elasticsearch logs? > [@Souvik\_Das](#): > > Is that that a security threat? Is your cluster accessible on internet? Or within your company? But without at least the default built-in security? ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 4, 2020, 9:42am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/3 "2020-05-04T09:42:49Z")
Yes it is accessible on the internet and I have tried to secure it using the https protocol. If I want to see the elasticsearch logs, how to do that? Please guide. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 4, 2020, 10:16am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/4 "2020-05-04T10:16:07Z")
> [@Souvik\_Das](#): > > I have tried to secure it using the https protocol HTTPS just encrypts communication over http. It does not prevent anyone to access your server. > [@Souvik\_Das](#): > > If I want to see the elasticsearch logs, how to do that? How did you install elasticsearch? The installation guide tells what is the default dir depending on the package you installed. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 4, 2020, 10:17am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/5 "2020-05-04T10:17:09Z")
You should read [https://www.elastic.co/blog/how-to-prevent-elasticsearch-server-breach-securing-elasticsearch](https://www.elastic.co/blog/how-to-prevent-elasticsearch-server-breach-securing-elasticsearch) ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 4, 2020, 10:42am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/6 "2020-05-04T10:42:20Z")
Thank you so much for your response. I'll go through the link to resolve the issue at my end. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 4, 2020, 11:01am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/7 "2020-05-04T11:01:02Z")
Note that the easiest way to have everything running and secured is just to start a cluster from [cloud.elastic.co](http://cloud.elastic.co). You have 14 days for free if you want to try it. ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 4, 2020, 11:14am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/8 "2020-05-04T11:14:21Z")
Hi David, Can I enable this feature in my existing system? as I've already done all of my work in this system and re work all the stuffs is bit difficult and time consuming for me. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 4, 2020, 11:31am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/9 "2020-05-04T11:31:26Z")
If you have elasticsearch 6.8 or 7.6, yes. Otherwise you need to buy a license. ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 4, 2020, 12:05pm UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/10 "2020-05-04T12:05:26Z")
My Kibana version is 6.8.7 How can I do that? Please suggest. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [May 4, 2020, 2:16pm UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/11 "2020-05-04T14:16:55Z")
I think that reading the documentation would help. See [https://www.elastic.co/guide/en/elasticsearch/reference/6.8/secure-cluster.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/secure-cluster.html) ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 5, 2020, 5:01am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/12 "2020-05-05T05:01:38Z")
Okay..thanks David.. ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 5, 2020, 6:19am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/13 "2020-05-05T06:19:52Z")
Hi David, Today when I was reviewing the indexes, I found an abnormal index name in the index management. ![threat](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e1f9858052a1985d75a7b8b28a730f60c0cb1da.png) I have not created that index. How that index came here? Is that a security breach? Has someone hacked the elasticsearch? Please have a look at it and advice what should be done from my end. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 5, 2020, 6:45am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/14 "2020-05-05T06:45:27Z")
> [@Souvik\_Das](#): > > I have not created that index. How that index came here? It looks like someone has accessed your cluster so it is clearly not secure. You need to secure the cluster and/or remove it from the internet. > [@Souvik\_Das](#): > > Is that a security breach? Yes, although technically you do not have any security in place to breach. > [@Souvik\_Das](#): > > Has someone hacked the elasticsearch? Yes. ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 5, 2020, 9:35am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/15 "2020-05-05T09:35:09Z")
Thanks for the advice Christian..I'll work on this.. ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [May 5, 2020, 3:37pm UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/16 "2020-05-05T15:37:01Z")
You really should remove that cluster and rebuild from scratch. I would never trust that cluster again.. you can restore the data in a new cluster if you have backups of only the data indices... ---
**Author:** ![Souvik\_Das](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/souvik_das/32/107606_2.png) [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Post date:** [May 6, 2020, 5:59am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/17 "2020-05-06T05:59:05Z")
Hi, I've closed the cluster to the internet. Now elasticsearch can be reached locally since the elk stack reside on the same server now. is that a feasible solution? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 3, 2020, 5:59am UTC](https://discuss.elastic.co/t/kibana-data-suddenly-got-missing/230943/18 "2020-06-03T05:59:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.