Hi,
I hope this is the correct group for asking about this behavior, sorry in
advance if it isn't but I would greatly appreciate some help. I'm pretty
new to ElasticSearch itself, currently trying to setup an ELK stack to
analyze a couple of logs.
Recently, I've tried to look around for a mechanism for data retiring and I
started looking into the flush/close/delete options in ES. What I would
like to do ultimately is create a cron job (maybe using Curator[1] for
help) that would close indexes over a couple a days and delete them after a
week. So as a test, I tried closing an index to see what would happen and,
after I closed it, I noticed this error in the Kibana interface:
Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];]
the same doesn't happen if I simply delete the index. I would like to
continue seeing data from more recent indexes in Kibana, but simply close
older ones. What am I doing wrong? Is there a way for me to keep some older
(Logstash sent) data closed in case I need to open and query it later?
Best regards,
Bruno C.
[1] https://github.com/elasticsearch/curator/
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/609afd12-b257-4a06-b690-88a1f9ed027f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
