From b93af9a94b03a1921c2cd029ac0409ad8e53edd4 Mon Sep 17 00:00:00 2001 From: ashwinkumar12345 Date: Mon, 19 Jul 2021 13:13:58 -0700 Subject: [PATCH] add ISM warning --- _im-plugin/ism/api.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/_im-plugin/ism/api.md b/_im-plugin/ism/api.md index 20646487..4b568ad6 100644 --- a/_im-plugin/ism/api.md +++ b/_im-plugin/ism/api.md @@ -160,6 +160,10 @@ POST _plugins/_ism/add/index_1 } ``` +If you use a wildcard `*` while adding a policy to an index, the ISM plugin interprets `*` as all indices, including system indices like `.opendistro-security`, which stores users, roles, and tenants. A delete action in your policy might accidentally delete all user roles and tenants in your cluster. +Don't use the broad `*` wildcard, and instead add a prefix, such as `my-logs*`, when specifying indices with the `_ism/add` API. +{: .warning } + ---