My index keep deleting for some reason

Elastic Stack Kibana
1

I notice that after some time i have to keep create my index template . Seems it is being automatically removed or delete i dont know about.

2

Can you clarify which index template and what your workflow is? Are there any daemons performing maintenance on the cluster?

3

mine is packetbeat .... actually it was fine for a few days until the last three days ... what i expect is something like /var/lib/elasticsearch/nodes/0/indices/my-index-template-name like packetbeat ... instead i have something like this /var/lib/elasticsearch/nodes/0/indices/RqmWCYYyRjisQ9f6hmgNtQ where my indesx is saved

and this unknown folder keeps eleting for some reason ......

4

Hi jbudz again ... i check my server elasticsearch log and find this line

[2018-05-12T05:01:53,378][INFO ][o.e.c.m.MetaDataDeleteIndexService] [pZaiU7N] [packetbeat-6.2.4-2018.05.12/rHMf8c1lTP6JiRDBz4QALQ] deleting index
[2018-05-12T05:02:01,231][INFO ][o.e.c.m.MetaDataDeleteIndexService] [pZaiU7N] [.kibana/A1P7KhS1QveGMbXGSWBqWQ] deleting index

i believe that is when index was deleted but the reason i dont know ... could a setting but i did not change anything since i first setup

5

Hi Jbudz any update

6

Hey, it does look like something is deleting the index. Did you have any stray DELETE requests? Based on the log timestamps I'm guessing there's something running a DELETE * on the cluster.

Can you share what kind of workload the cluster is under?

7

thanks jbudz for info i will check and get back asap

8

Hi Jbudz
Sorry but i couldn't find anything that automatically delete my index. How can i check my workload ... actually there is onle one node on the cluster

9

funny thing is this only happen to my 6.2 stack .... i have older version which is work perfect. Now i will send my data to that for now while check my newer version issue ...

10

You can try disabling wildcard deletes by setting action.destructive_requires_name or locking the index down if you're using the security plugin.

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html.

Alternatively if there's a proxy in front you may be able to grab the requesters IP.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.