The action.destructive_requires_name setting is a crucial safety feature in Elasticsearch that controls whether destructive actions (such as deleting indices) require explicit index names or allow wildcard expressions.
- Default value:
true - Possible values:
trueorfalse - Recommendation: Keep the default value (
true) for production environments to prevent accidental data loss.
When set to true, this setting requires that destructive operations explicitly specify the index name(s) they target, rather than using wildcard patterns or _all. This acts as a safeguard against unintended bulk deletions or modifications.
Example
To change this setting using the cluster settings API:
PUT _cluster/settings
{
"persistent": {
"action.destructive_requires_name": false
}
}
Changing this to false would allow operations like:
DELETE /_all
or
DELETE /index_*
However, this is generally not recommended as it increases the risk of accidental data loss.
Common Issues and Misuses
- Attempting to delete indices using wildcards when the setting is
truewill result in an error. - Some users might disable this setting for convenience, significantly increasing the risk of data loss.
Do's and Don'ts
Do's:
- Keep this setting enabled (
true) in production environments. - Use explicit index names in destructive operations.
- Implement additional safeguards like role-based access control.
Don'ts:
- Don't disable this setting unless you have a very specific and well-understood reason.
- Avoid using wildcard patterns in destructive operations, even if the setting is disabled.
Frequently Asked Questions
Q: Why can't I delete multiple indices using wildcards?
A: This is likely because action.destructive_requires_name is set to true, which is the default. This setting prevents wildcard deletions as a safety measure.
Q: How can I delete all indices if this setting is enabled?
A: You can't delete all indices with a single command when this setting is enabled. You must explicitly list each index you want to delete. This is a safety feature to prevent accidental bulk deletions.
Q: Is it safe to disable this setting in a production environment?
A: It is generally not recommended to disable this setting in production. Doing so increases the risk of accidental data loss through unintended bulk operations.
Q: Can this setting be overridden for specific API calls?
A: No, this setting applies cluster-wide and cannot be overridden for individual API calls. It's a global safety measure.
Q: How does this setting affect snapshot and restore operations?
A: This setting doesn't directly affect snapshot and restore operations. However, it's good practice to use explicit index names in these operations regardless of this setting to ensure clarity and prevent mistakes.
