Action Destructive Requires Name
The cluster still allows destructive index operations with wildcards or _all, so one delete request can target many indices at once. That pattern is a common source of accidental full data loss in operations incidents.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Cluster |
| Domains | security-safety |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
No description available.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Prevent deletion of wildcard indices
Condition: Always shown for this insight.
Enable action.destructive_requires_name so index deletes must name a specific index and cannot use wildcards. Use the action below.
PUT _cluster/settings
{
"persistent": {
"action.destructive_requires_name": "true"
}
}
Requires the manage cluster privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
Impact: The use of wildcards comes with the risk of accidental full data deletion. It is possible to reduce the risk of accidental deletion of indices by preventing the use of wildcards for destructive (delete) operations. It is recommended to turn off deleting indices via wildcards or all.