I notice that after some time i have to keep create my index template . Seems it is being automatically removed or delete i dont know about.
Can you clarify which index template and what your workflow is? Are there any daemons performing maintenance on the cluster?
mine is packetbeat .... actually it was fine for a few days until the last three days ... what i expect is something like /var/lib/elasticsearch/nodes/0/indices/my-index-template-name like packetbeat ... instead i have something like this /var/lib/elasticsearch/nodes/0/indices/RqmWCYYyRjisQ9f6hmgNtQ where my indesx is saved
and this unknown folder keeps eleting for some reason ......
Hi jbudz again ... i check my server elasticsearch log and find this line
[2018-05-12T05:01:53,378][INFO ][o.e.c.m.MetaDataDeleteIndexService] [pZaiU7N] [packetbeat-6.2.4-2018.05.12/rHMf8c1lTP6JiRDBz4QALQ] deleting index
[2018-05-12T05:02:01,231][INFO ][o.e.c.m.MetaDataDeleteIndexService] [pZaiU7N] [.kibana/A1P7KhS1QveGMbXGSWBqWQ] deleting index
i believe that is when index was deleted but the reason i dont know ... could a setting but i did not change anything since i first setup
Hi Jbudz any update
Hey, it does look like something is deleting the index. Did you have any stray DELETE requests? Based on the log timestamps I'm guessing there's something running a
DELETE * on the cluster.
Can you share what kind of workload the cluster is under?
thanks jbudz for info i will check and get back asap
Sorry but i couldn't find anything that automatically delete my index. How can i check my workload ... actually there is onle one node on the cluster
funny thing is this only happen to my 6.2 stack .... i have older version which is work perfect. Now i will send my data to that for now while check my newer version issue ...
You can try disabling wildcard deletes by setting action.destructive_requires_name or locking the index down if you're using the security plugin.
Alternatively if there's a proxy in front you may be able to grab the requesters IP.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.