A non-system index is a user-created Elasticsearch index that stores application or operational data, such as logs, records, or documents. It is distinct from system indices, which hold internal cluster metadata and support Elasticsearch itself.
This distinction matters in security because attackers who reach a cluster may try to enumerate or export every non-system index to collect valuable data in bulk. Defenders also use the concept when reviewing exposure, because sensitive business data often lives outside system areas and is easy to overlook. In attacks, tools may target a single index or sweep all non-system indices to maximize theft. In defense, restricting access, monitoring index-level requests, and separating data sets can limit how much an exposed cluster reveals.