See my post above yours on here. I was having the same problem, my indexes disappeared every two or three weeks. I think my server was being hit with a “meow” attack because port 9200 was accidentally open to the outside world.
It could be that you have port 9200 open. Or like me, you could have ES running in docker and think you’ve got it locked down since you’re using a firewall to block port 9200. The thing is, docker apparently bypasses the firewall rules by default. But there’s a solution for that in the link I provided.
I just implemented the fix today, so I don’t know if this is actually the fix, but reading about the meow attack, it seems to check out.