It is mainly data from the Apache Ranger audit. As sometimes (when a lot of users are logging in,...) the data stored here can grow a lot, I thought that the best way to deal with it was limiting this index (although there are more stored in my ES instance, it is not the only one), although I don't know if this could be done in ES.