# Why are my indexes automatically removed?

**URL:** <https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857>\
**Category:** Elasticsearch\
**Created:** [August 1, 2023, 8:53pm UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857 "2023-08-01T20:53:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Miguel3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miguel3/32/124193_2.png) [@Miguel3](https://discuss.elastic.co/u/Miguel3)\
**Post date:** [August 1, 2023, 8:53pm UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857/1 "2023-08-01T20:53:03Z")

</div>

I have a problem with my elastic instance, after a few days of creating and uploading data to my indexes they are automatically deleted, I don't understand why it's happening and I don't see any message in the logs that can understand the reason

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f6b2cb530db7260aa3cfdf4f7c3f17a27b1c6e3.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 1, 2023, 8:57pm UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857/2 "2023-08-01T20:57:16Z")

</div>

> [@Miguel3](#):
>
> I have a problem with my elastic instance, after a few days of creating and uploading data to my indexes they are automatically deleted

Is your instance available on the internet? Does it have any authentication?

From what you shared it seems that your instance is available on the internet without authentication and someone is deleting your indices.

Just before the delete messages you can see that there is a creation of an index named `read_me`, which was probably created by the same person that deleted your indices.

---

<div class="post-metadata">

**Author:** ![Miguel3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miguel3/32/124193_2.png) [@Miguel3](https://discuss.elastic.co/u/Miguel3)\
**Post date:** [August 1, 2023, 10:30pm UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857/3 "2023-08-01T22:30:37Z")

</div>

Ah, well, if it's available to the internet, it's a development instance, is there any simple guide to add authentication to each request to the api? I have my instance in docker with version 8.5.3

---

<div class="post-metadata">

**Author:** ![Miguel3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miguel3/32/124193_2.png) [@Miguel3](https://discuss.elastic.co/u/Miguel3)\
**Post date:** [August 1, 2023, 10:37pm UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857/4 "2023-08-01T22:37:40Z")

</div>

and well, reviewing the content of that index I see that they are asking for a ransom for it, xD but it is test data so there is no problem,

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43ed538fefb61243c10c94f3bbb3b52cfa225f14.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 2, 2023, 4:38am UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857/5 "2023-08-02T04:38:19Z")

</div>

In version 8 security is enabled per default, to have a cluster without authentication you would need to explicitly disable security.

How are you running your docker? I do not use docker, but I recommend that you follow the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#docker).

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 2, 2023, 8:13am UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857/6 "2023-08-02T08:13:59Z")

</div>

Please don't post images of text as they are hard to read, may not display correctly for everyone, and are not searchable.

Instead, paste the text and format it with `</>` icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer.

It would be great if you could update your post to solve this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2023, 8:14am UTC](https://discuss.elastic.co/t/why-are-my-indexes-automatically-removed/339857/7 "2023-08-30T08:14:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
