I have a use case in which there is an index I no longer need, but have some small chance of using in the future. Closing the index or freezing the index both look like reasonable ways of keeping the data from being gone forever in case I need it some day while not wasting too many resources on it while it is not in use. I'm trying to decide which option is better (close vs. freeze).
I understand that freeze allows me to query the index if I really need to it while it is archived, while close does not. I understand that freeze requires X-Pack while close does not. However, neither of these matters to me. I have X-Pack and I won't be querying the index unless I resurrect it, in which case I will open/ unfreeze it first anyway.
Given these, which option is better? I haven't found a comparison between the two so I imagine one of the following is true, but I'm not sure which:
- A frozen index uses more cluster resources than a closed one in order to make the index still searchable. If you aren't searching it, closing is more efficient than freezing .
- Freeze is a newer replacement for close, and is recommended for new applications even if you aren't querying the index. A frozen index isn't any more expensive to keep around than a closed one.
Which of the above two is more accurate? Or is the situation different/ more complicated than these bullets suggest?