Can't see frozen index spans

[amcsi (Attila Szeremi)]

I was logging transactions with spans to APM. After realizing that spans took up too much space, I decided to set up and apply an index lifecycle for spans to go cold after 11-15 days, then get deleted after 30 days.

But those indexes that are frozen I can't seem to query at all; not from the Kibana logs, nor can I see the spans from the transactions in APM; only the ones from roughly 11 days ago. I thought frozen indexes are still supposed to be accessible, so how come I can't access them?

I have uploaded a screenshot of my Index Lifecycle configuration for spans, and also the current list of span indexes.

Kibana version: 7.8.0

Elasticsearch version: 7.8.0

APM Server version: 7.8.0

[dgieselaar (Dario Gieselaar)]

Hey @amcsi, searching frozen indices is off by default, because it has a performance impact. If you want to enable it, you can try setting search:includeFrozen to true in Kibana Advanced Settings: Advanced Settings | Kibana Guide [8.1] | Elastic. (The setting is deprecated and will be removed in 9.0, I'm not sure what the replacement is off the top of my head).