# Unknown reason of All Elastic indices deletion repeatedly **URL:** \ **Category:** Elasticsearch\ **Created:** [August 2, 2023, 11:24am UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934 "2023-08-02T11:24:25Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![usman1](https://avatars.discourse-cdn.com/v4/letter/u/c67d28/32.png) [@usman1](https://discuss.elastic.co/u/usman1)\ **Post date:** [August 2, 2023, 11:24am UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/1 "2023-08-02T11:24:26Z")
My elasticsearch instance is deployed in an EC2 instance and due to some reason, all my indices got deleted on 20th of July. After recovering the data on 30th, they got deleted again on 31st and then on 1st of August again. The logs I get in the instance only shows this: ```auto [2023-07-31T13:41:27,254][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-dgm/jkBMPK-oSKAEvQ] deleting index [2023-07-31T13:41:27,465][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-feathb/VOfbkiiLc79j3pw] deleting index [2023-07-31T13:41:27,671][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-ftfarms/RLRxZoFmHBAJahQk-7g] deleting index [2023-07-31T13:41:27,915][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-hhunter/uhWGY7EYVQxgow] deleting index [2023-07-31T13:41:28,128][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-pal/ei3pGyzJTHZ7JCUM9FbA] deleting index [2023-07-31T13:41:28,322][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-primaf/9Z7wXXCNmN_G7KtPEA] deleting index [2023-07-31T13:41:28,522][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-rvemery/GyQQARSOdG_bnLgistg] deleting index [2023-07-31T13:41:28,764][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-tasker/QPbcgsf2ZPN2_zIUrqg] deleting index [2023-07-31T13:41:28,974][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-test/oSt0FpsMev--OJXHkSLw] deleting index [2023-07-31T13:41:29,166][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [mw-index-wyefruit/H8CIRCyowdyvXupbTQ] deleting index [2023-07-31T13:41:29,363][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [prod-index-pal/pNpaX8rftHgmAasw] deleting index [2023-07-31T13:41:29,559][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [prod-index-wyefruit/UxqnrA_XQdql-akruADvTQ] deleting index [2023-07-31T13:41:29,757][INFO][o.e.c.m.MetadataDeleteIndexService] [node-1] [read_me/skSU0SH_QRyoGhOzTFj76A] deleting inde ``` Any help will be appreciated. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 2, 2023, 11:26am UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/2 "2023-08-02T11:26:42Z")
Have a look at [this thread](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857), which likely is related. ---
**Author:** ![usman1](https://avatars.discourse-cdn.com/v4/letter/u/c67d28/32.png) [@usman1](https://discuss.elastic.co/u/usman1)\ **Post date:** [August 2, 2023, 12:10pm UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/3 "2023-08-02T12:10:47Z")
Thanks for pointing me to the right thread. Any thoughts on how to avoid such scenarios and improve the security of Elasticsearch instance? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 2, 2023, 12:11pm UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/4 "2023-08-02T12:11:37Z")
I would recommend you enable security, which you likely have not got enabled at the moment. Which version of Elasticsearch are you using? ---
**Author:** ![usman1](https://avatars.discourse-cdn.com/v4/letter/u/c67d28/32.png) [@usman1](https://discuss.elastic.co/u/usman1)\ **Post date:** [August 2, 2023, 12:20pm UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/5 "2023-08-02T12:20:33Z")
I have been a newbie to this so don't even know whether security is enabled or not. Any guide that I can follow to enable the security? I am willing to get the x-pack thing as well, if needed. Version number is 7.17.3 ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 2, 2023, 12:24pm UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/6 "2023-08-02T12:24:29Z")
In 7.17 basic security is available with the free basic license. I think [the official docs](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/configuring-stack-security.html) is a great starting point. If you are just starting out I would recommend insrtead starting with the latest 8.x release as security setup is greatly improved there. ---
**Author:** ![usman1](https://avatars.discourse-cdn.com/v4/letter/u/c67d28/32.png) [@usman1](https://discuss.elastic.co/u/usman1)\ **Post date:** [August 2, 2023, 12:25pm UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/7 "2023-08-02T12:25:49Z")
Do you think upgrading to the newest version is more important or enabling the security of existing version will be sufficient? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 30, 2023, 12:26pm UTC](https://discuss.elastic.co/t/unknown-reason-of-all-elastic-indices-deletion-repeatedly/339934/8 "2023-08-30T12:26:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.