For the past 2 mondays, I come in the office and our main elasticsearch index has been dropped and recreated during the weekend.
We "sync" our ES instance from SqlServer using code which has been written 2-3 years ago and has worked up to now.
This code seems to be the only culprit as of now, part of it looks up if any documents are missing in the database and deletes them in elasticsearch. This line of ColdFusion code will build the delete http command to send and deletes an ES document.
UrlToCall = "#SearchEndPoint#/#SearchIndex#/#SearchIndexType#/#item.itemid#-#item.itemtype#-#merchants.id#-#item.dealerid#"
What I'm thinking is this piece of code could have a null value within one of it's variables which could lead to an entire index getting dropped.
E.G. instead of calling
DELETE 10.11.12.13:9200/bunch-of-products/product/414-1-2323-0
it would call
DELETE 10.11.12.13:9200/bunch-of-products/ / - -
I've tried a lot of different syntaxes and while I think this could have hapenned I just can't find the actual syntax that's required for this query to drop the index.
( obviously I know DELETE 10.11.12.13:9200/bunch-of-products/ would drop it )