# Strange indices **URL:** \ **Category:** Elasticsearch\ **Created:** [December 29, 2017, 12:22pm UTC](https://discuss.elastic.co/t/strange-indices/113585 "2017-12-29T12:22:44Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Tamizh](https://avatars.discourse-cdn.com/v4/letter/t/8c91f0/32.png) [@Tamizh](https://discuss.elastic.co/u/Tamizh)\ **Post date:** [December 29, 2017, 12:22pm UTC](https://discuss.elastic.co/t/strange-indices/113585/1 "2017-12-29T12:22:45Z")
> [@Strange indexes](https://discuss.elastic.co/t/strange-indexes/31305): > > Hi there! I have an ES Cluster. And everyday strange indexes are creating. It looks like [image] In logs I see next root@logstashm:~# cat /var/log/elasticsearch/cloud.log | grep awgasv1.html [2015-09-29 08:13:36,632][DEBUG][action.search.type] [master] [awgasv1.html][0], node[NC2z-jpoSh6uGbllA4fGcQ], [R], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@10555f9c] lastShard [true] Caused by: org.elasticsearch.search.SearchParseException: [awgasv1.html][0]: q… > [@Strange indicies](https://discuss.elastic.co/t/strange-indicies/26774): > > Hello everyone! I have a ES cluster - 1master(with logstash) and 3 data nodes. Few days ago I noticed strange thing. In KOPF strange indicies began to appear: [http://prntscr.com/80m51b](http://prntscr.com/80m51b) I delete them, but next day they back again! Can anyone tell me what the \* is going on? slight_smile Thanks! I have already checked these two threads, But they did scanning and other things. But I never did anything. and moreover, i use Nginx for reverse proxy. so it is not open to the internet. I want to know what these indices means. (blazeds, flex2gateway, lcds, messagebroker, webui). Please some one help me with this. Thank You ! ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 29, 2017, 1:10pm UTC](https://discuss.elastic.co/t/strange-indices/113585/2 "2017-12-29T13:10:13Z")
How do you create data? What those indices contain? ---
**Author:** ![Tamizh](https://avatars.discourse-cdn.com/v4/letter/t/8c91f0/32.png) [@Tamizh](https://discuss.elastic.co/u/Tamizh)\ **Post date:** [December 29, 2017, 1:16pm UTC](https://discuss.elastic.co/t/strange-indices/113585/3 "2017-12-29T13:16:00Z")
Those indices contain nothing. I can't get your question of "How do you create data". But i am sure i never created those indices. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 29, 2017, 1:43pm UTC](https://discuss.elastic.co/t/strange-indices/113585/4 "2017-12-29T13:43:01Z")
My question is related to how you are sending your data to elasticsearch. Not related to those indices. Something/someone is doing ``` PUT foo ``` I'm just trying to understand what this could be ---
**Author:** ![Tamizh](https://avatars.discourse-cdn.com/v4/letter/t/8c91f0/32.png) [@Tamizh](https://discuss.elastic.co/u/Tamizh)\ **Post date:** [December 29, 2017, 2:05pm UTC](https://discuss.elastic.co/t/strange-indices/113585/5 "2017-12-29T14:05:56Z")
I always create a template and create the indices dynamically programmatically. I used to create indices using PUT in kibana console. But I never create a template or indices on those names. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 29, 2017, 2:28pm UTC](https://discuss.elastic.co/t/strange-indices/113585/6 "2017-12-29T14:28:10Z")
If you are 100% sure it means that someone else can do this and is doing this. Or you have a bug in your code. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 29, 2017, 7:19pm UTC](https://discuss.elastic.co/t/strange-indices/113585/7 "2017-12-29T19:19:35Z")
If your cluster has no authentication, then it's probably something internally connecting to your cluster and requesting a URL that doesn't exist, and Elasticsearch thinks it's a request for an index, that also doesn't exist, and so creates it. This usually happens due to security scan software seeing that the Elasticsearch host has port 9200 open as a HTTP server, and it runs a few checks that does this. ---
**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\ **Post date:** [December 31, 2017, 4:37pm UTC](https://discuss.elastic.co/t/strange-indices/113585/8 "2017-12-31T16:37:15Z")
As @warkolm mentions, I have seen security scanning software do exactly this (e.g., Nessus). ---
**Author:** ![Tamizh](https://avatars.discourse-cdn.com/v4/letter/t/8c91f0/32.png) [@Tamizh](https://discuss.elastic.co/u/Tamizh)\ **Post date:** [January 1, 2018, 5:22pm UTC](https://discuss.elastic.co/t/strange-indices/113585/9 "2018-01-01T17:22:01Z")
But i never installed Nessus in my node. ---
**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\ **Post date:** [January 1, 2018, 5:57pm UTC](https://discuss.elastic.co/t/strange-indices/113585/10 "2018-01-01T17:57:59Z")
I think there’s some confusion here. Let me clarify. It doesn’t have to be Nessus, it could be other software. It doesn’t have to be running on your local node (Nessus doesn’t), it could be any machine anywhere in the world that has network connectivity to your Elasticsearch instance. I’m going to be very clear here: Elasticsearch is not creating these indices without some external process triggering this. Some process is hitting endpoints on your Elasticsearch instance that lead to indices being created. There is nothing inside of Elasticsearch that would do this without an external trigger. You could tcpdump traffic destined for the ports your Elasticsearch instance is listening on and find where the API invocations that are triggering these are coming from. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 1, 2018, 7:02pm UTC](https://discuss.elastic.co/t/strange-indices/113585/11 "2018-01-01T19:02:21Z")
Or install X-Pack so you get access control. ---
**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\ **Post date:** [January 1, 2018, 7:09pm UTC](https://discuss.elastic.co/t/strange-indices/113585/12 "2018-01-01T19:09:18Z")
That will still not reveal to this user the source of these. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 29, 2018, 7:09pm UTC](https://discuss.elastic.co/t/strange-indices/113585/13 "2018-01-29T19:09:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.