What you're seeing with that error is that the time window selected in Kibana includes indices which have been marked closed. Elasticsearch is simply passing on the message, "I can't query that, it's closed" on to Kibana. It's a non-fatal error.
You can avoid the error by selecting a time window that does not include closed indices. --Aaron On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote: > > Hi, > > I hope this is the correct group for asking about this behavior, sorry in > advance if it isn't but I would greatly appreciate some help. I'm pretty > new to ElasticSearch itself, currently trying to setup an ELK stack to > analyze a couple of logs. > > Recently, I've tried to look around for a mechanism for data retiring and > I started looking into the flush/close/delete options in ES. What I would > like to do ultimately is create a cron job (maybe using Curator[1] for > help) that would close indexes over a couple a days and delete them after a > week. So as a test, I tried closing an index to see what would happen and, > after I closed it, I noticed this error in the Kibana interface: > > Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];] > > the same doesn't happen if I simply delete the index. I would like to > continue seeing data from more recent indexes in Kibana, but simply close > older ones. What am I doing wrong? Is there a way for me to keep some older > (Logstash sent) data closed in case I need to open and query it later? > > Best regards, > > Bruno C. > > > [1] https://github.com/elasticsearch/curator/ > -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
