# Strange indexes **URL:** \ **Category:** Elasticsearch\ **Created:** [September 29, 2015, 6:33am UTC](https://discuss.elastic.co/t/strange-indexes/31305 "2015-09-29T06:33:28Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [September 29, 2015, 6:33am UTC](https://discuss.elastic.co/t/strange-indexes/31305/1 "2015-09-29T06:33:29Z")
Hi there! I have an ES Cluster. And everyday strange indexes are creating. It looks like ![](https://us1.discourse-cdn.com/elastic/original/2X/8/85413ee11d89a99fae0578d0a30101ebdc51ad2c.png) In logs I see next ``` root@logstashm:~# cat /var/log/elasticsearch/cloud.log | grep awgasv1.html [2015-09-29 08:13:36,632][DEBUG][action.search.type] [master] [awgasv1.html][0], node[NC2z-jpoSh6uGbllA4fGcQ], [R], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@10555f9c] lastShard [true] Caused by: org.elasticsearch.search.SearchParseException: [awgasv1.html][0]: query[ConstantScore(*:*)],from[-1],size[1]: Parse Failure [Failed to parse source [{ [2015-09-29 08:13:36,634][DEBUG][action.search.type] [master] [awgasv1.html][3], node[U0CUUzB8SwKlfzatrCsdFg], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@10555f9c] lastShard [true] Caused by: org.elasticsearch.search.SearchParseException: [awgasv1.html][3]: query[ConstantScore(*:*)],from[-1],size[1]: Parse Failure [Failed to parse source [{ [2015-09-29 08:13:36,636][DEBUG][action.search.type] [master] [awgasv1.html][1], node[N9Z7j6TbQjaSdIkBIHoSgw], [R], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@10555f9c] lastShard [true] Caused by: org.elasticsearch.search.SearchParseException: [awgasv1.html][1]: query[ConstantScore(*:*)],from[-1],size[1]: Parse Failure [Failed to parse source [{ [2015-09-29 08:13:36,643][DEBUG][action.search.type] [master] [awgasv1.html][2], node[mHZaE0aCSQ2lOLzV0AEn-w], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@10555f9c] lastShard [true] Caused by: org.elasticsearch.search.SearchParseException: [awgasv1.html][2]: query[ConstantScore(*:*)],from[-1],size[1]: Parse Failure [Failed to parse source [{ [2015-09-29 08:13:36,646][DEBUG][action.search.type] [master] [awgasv1.html][4], node[N9Z7j6TbQjaSdIkBIHoSgw], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@10555f9c] lastShard [true] Caused by: org.elasticsearch.search.SearchParseException: [awgasv1.html][4]: query[ConstantScore(*:*)],from[-1],size[1]: Parse Failure [Failed to parse source [{ ``` Give me please some advice. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 29, 2015, 6:38am UTC](https://discuss.elastic.co/t/strange-indexes/31305/2 "2015-09-29T06:38:02Z")
Is your ES instance open to the internet? It looks like someone is trying to exploit vulnerabilities in other programs. ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [September 29, 2015, 6:41am UTC](https://discuss.elastic.co/t/strange-indexes/31305/3 "2015-09-29T06:41:40Z")
What do you mean, world wide internet? This cluster in my LAN and used only in my network. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 29, 2015, 7:41am UTC](https://discuss.elastic.co/t/strange-indexes/31305/4 "2015-09-29T07:41:54Z")
Someone is making requests to your cluster that ends up with these being created. You can disable auto creation of indices if you want - `action.auto_create_index: false` in `elasticsearch.yml`. ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [September 29, 2015, 7:46am UTC](https://discuss.elastic.co/t/strange-indexes/31305/5 "2015-09-29T07:46:48Z")
I need an auto create of logstash index everyday, this option will disable it? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 29, 2015, 7:54am UTC](https://discuss.elastic.co/t/strange-indexes/31305/6 "2015-09-29T07:54:36Z")
No because you are leveraging a template for Logstash. ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [September 29, 2015, 7:55am UTC](https://discuss.elastic.co/t/strange-indexes/31305/7 "2015-09-29T07:55:34Z")
> [@warkolm](#): > > No because you are leveraging a template for Logstash. Thanks, I will try! ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [September 30, 2015, 6:51am UTC](https://discuss.elastic.co/t/strange-indexes/31305/8 "2015-09-30T06:51:11Z")
I didnt have any time to set up this option yesterday, and today in logs i see ``` [2015-09-30 08:14:24,651][INFO][cluster.metadata] [master] [perl] creating index, cause [api], templates [], shards [5]/[1], mappings [] [2015-09-30 08:14:31,222][INFO][cluster.metadata] [master] [spipe] creating index, cause [api], templates [], shards [5]/[1], mappings [] [2015-09-30 08:14:41,712][INFO][cluster.metadata] [master] [webui] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [apps] [2015-09-30 08:15:04,150][INFO][cluster.metadata] [master] [flex2gateway] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [http] [2015-09-30 08:15:05,062][INFO][cluster.metadata] [master] [messagebroker] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [http] [2015-09-30 08:15:05,720][INFO][cluster.metadata] [master] [blazeds] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [messagebroker] [2015-09-30 08:15:06,719][INFO][cluster.metadata] [master] [lcds] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [messagebroker] [2015-09-30 08:15:07,206][INFO][cluster.metadata] [master] [asvnpo1.html] creating index, cause [api], templates [], shards [5]/[1], mappings [] [2015-09-30 08:15:08,015][INFO][cluster.metadata] [master] [phppath] creating index, cause [auto(index api)], templates [], shards [5]/[1], mappings [php] ``` so as i understand it creates by index api? how can I prevent it ? Thanks ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [September 30, 2015, 7:51am UTC](https://discuss.elastic.co/t/strange-indexes/31305/9 "2015-09-30T07:51:50Z")
It sounds like to me that your injector is misconfigured or that a colleague is sending you some PUT requests. Looks like you are creating an index instead of documents. What is your elasticsearch logstash config? ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [September 30, 2015, 8:19am UTC](https://discuss.elastic.co/t/strange-indexes/31305/10 "2015-09-30T08:19:10Z")
elasticsearch.yml [http://pastebin.com/3t29HKfv](http://pastebin.com/3t29HKfv) logstash.conf [http://pastebin.com/cRJqQHnV](http://pastebin.com/cRJqQHnV) ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [September 30, 2015, 9:49am UTC](https://discuss.elastic.co/t/strange-indexes/31305/11 "2015-09-30T09:49:35Z")
So it's not logstash are logstash with this configuration will only write events to `logstash-*` indices. Definitely someone is sending over your network some `PUT` requests to your elasticsearch instance. ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [September 30, 2015, 9:52am UTC](https://discuss.elastic.co/t/strange-indexes/31305/12 "2015-09-30T09:52:15Z")
Thanks for explain. Can I trace it somehow? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [September 30, 2015, 10:04am UTC](https://discuss.elastic.co/t/strange-indexes/31305/13 "2015-09-30T10:04:35Z")
You can probably install [Shield plugin](https://www.elastic.co/guide/en/shield/current/index.html) and activate [auditing](https://www.elastic.co/guide/en/shield/current/configuring-auditing.html). ---
**Author:** ![levichen](https://avatars.discourse-cdn.com/v4/letter/l/e9a140/32.png) [@levichen](https://discuss.elastic.co/u/levichen)\ **Post date:** [October 26, 2015, 8:08am UTC](https://discuss.elastic.co/t/strange-indexes/31305/14 "2015-10-26T08:08:00Z")
HI it2, I also find these strange indexes in my ES cluster. such as `flex2gateway`, `spipe`, `arneav1.html` etc.. And I find the reason! Do you ever using vulnerability scanner such as Nessus to scan your ES cluster LAN? I find these strange indexes and I delete these, after a while I check no these strange indexes in my ES cluster. I scan the ES cluster via Nessus these strange indexes had created again! So I think is Nessus do this. ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [October 26, 2015, 8:19am UTC](https://discuss.elastic.co/t/strange-indexes/31305/15 "2015-10-26T08:19:34Z")
Oh. I have Nessus in my LAN... I will disable cluster from scanning! THANKS! ---
**Author:** ![asatsi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asatsi/32/28417_2.png) [@asatsi](https://discuss.elastic.co/u/asatsi)\ **Post date:** [December 29, 2015, 8:02am UTC](https://discuss.elastic.co/t/strange-indexes/31305/16 "2015-12-29T08:02:54Z")
Interesting thread. I also see exactly same name indices in my cluster. However I am not sure whether any scans are happening on it. Could be possible. index ngnrge1.html lcds ngpsvw1.html perl pvwvpp1.html webui spipe messagebroker blazeds phppath evrers1.html flex2gateway ---
**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\ **Post date:** [December 29, 2015, 8:25am UTC](https://discuss.elastic.co/t/strange-indexes/31305/17 "2015-12-29T08:25:49Z")
Answer is above - NESSUS Chek your network for scaner activity. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:28pm UTC](https://discuss.elastic.co/t/strange-indexes/31305/18 "2017-07-05T23:28:10Z")