# Strange indicies

**URL:** <https://discuss.elastic.co/t/strange-indicies/26774>\
**Category:** Elasticsearch\
**Created:** [August 4, 2015, 6:20am UTC](https://discuss.elastic.co/t/strange-indicies/26774 "2015-08-04T06:20:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\
**Post date:** [August 4, 2015, 6:20am UTC](https://discuss.elastic.co/t/strange-indicies/26774/1 "2015-08-04T06:20:02Z")

</div>

Hello everyone!  
I have a ES cluster - 1master(with logstash) and 3 data nodes.  
Few days ago I noticed strange thing.  
In KOPF strange indicies began to appear: [http://prntscr.com/80m51b](http://prntscr.com/80m51b)  
I delete them, but next day they back again!  
Can anyone tell me what the \* is going on? 🙂  
Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 4, 2015, 6:21am UTC](https://discuss.elastic.co/t/strange-indicies/26774/2 "2015-08-04T06:21:38Z")

</div>

It looks like your ES cluster is wide open to the Internet or that there's malicious software on your internal network. Find the hole and close it.

---

<div class="post-metadata">

**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\
**Post date:** [August 4, 2015, 7:59am UTC](https://discuss.elastic.co/t/strange-indicies/26774/3 "2015-08-04T07:59:37Z")

</div>

There is no NAT for cluster.  
I will scan my system, its strange.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 4, 2015, 8:02am UTC](https://discuss.elastic.co/t/strange-indicies/26774/4 "2015-08-04T08:02:00Z")

</div>

How is this related to network address translation?

---

<div class="post-metadata">

**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\
**Post date:** [August 4, 2015, 9:00am UTC](https://discuss.elastic.co/t/strange-indicies/26774/5 "2015-08-04T09:00:16Z")

</div>

> [@magnusbaeck](#):
>
> It looks like your ES cluster is wide open to the Internet

> [@magnusbaeck](#):
>
> How is this related to network address translation?

My cluster works in LAN. And to Internet we go through NAT.  
How it can be wide open else? Maybe I dont understand something(

---

<div class="post-metadata">

**Author:** ![it2](https://avatars.discourse-cdn.com/v4/letter/i/f14d63/32.png) [@it2](https://discuss.elastic.co/u/it2)\
**Post date:** [August 5, 2015, 6:38am UTC](https://discuss.elastic.co/t/strange-indicies/26774/6 "2015-08-05T06:38:25Z")

</div>

There must be curl requests somewhere to create these indices.  
Am I right?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:57pm UTC](https://discuss.elastic.co/t/strange-indicies/26774/7 "2017-07-05T23:57:21Z")

</div>