kibana - why indices are getting deleted from elasticsearch on Sunday 06:00 UTC?

Question

I have hosted Elasticsearch and Kibana on a Azure VM. I send application logs to elasticsearch. On every Sunday 06:00 UTC all indices are being deleted from elasticsearch. I checked the index lifecycle policy, there is no index lifecycle policy attached to any indexes. How can I prevent deletion ? any help would be appreciated, Thanks.

Answer 1

Are you having any authentication in your ES cluster if no, check if its due to meow attack, you can follow elastic blog on the attack and how to prevent it for free.