ClusterBlockException after closing an index

Hi,

I hope this is the correct group for asking about this behavior, sorry in
advance if it isn't but I would greatly appreciate some help. I'm pretty
new to ElasticSearch itself, currently trying to setup an ELK stack to
analyze a couple of logs.

Recently, I've tried to look around for a mechanism for data retiring and I
started looking into the flush/close/delete options in ES. What I would
like to do ultimately is create a cron job (maybe using Curator[1] for
help) that would close indexes over a couple a days and delete them after a
week. So as a test, I tried closing an index to see what would happen and,
after I closed it, I noticed this error in the Kibana interface:

 Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];]

the same doesn't happen if I simply delete the index. I would like to
continue seeing data from more recent indexes in Kibana, but simply close
older ones. What am I doing wrong? Is there a way for me to keep some older
(Logstash sent) data closed in case I need to open and query it later?

Best regards,

Bruno C.

[1] https://github.com/elasticsearch/curator/

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/609afd12-b257-4a06-b690-88a1f9ed027f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

What you're seeing with that error is that the time window selected in
Kibana includes indices which have been marked closed. Elasticsearch is
simply passing on the message, "I can't query that, it's closed" on to
Kibana. It's a non-fatal error.

You can avoid the error by selecting a time window that does not include
closed indices.

--Aaron

On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote:

Hi,

I hope this is the correct group for asking about this behavior, sorry in
advance if it isn't but I would greatly appreciate some help. I'm pretty
new to ElasticSearch itself, currently trying to setup an ELK stack to
analyze a couple of logs.

Recently, I've tried to look around for a mechanism for data retiring and
I started looking into the flush/close/delete options in ES. What I would
like to do ultimately is create a cron job (maybe using Curator[1] for
help) that would close indexes over a couple a days and delete them after a
week. So as a test, I tried closing an index to see what would happen and,
after I closed it, I noticed this error in the Kibana interface:

 Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];]

the same doesn't happen if I simply delete the index. I would like to
continue seeing data from more recent indexes in Kibana, but simply close
older ones. What am I doing wrong? Is there a way for me to keep some older
(Logstash sent) data closed in case I need to open and query it later?

Best regards,

Bruno C.

[1] https://github.com/elasticsearch/curator/

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Hey Aaron,

I've since figured out a way to stop that by giving an alias to certain
indexes and only letting Kibana query those. Still, thanks for the help and
the response, hope it will help other people that encounter this error!

Merry Christmas, cheers!

Bruno Cruz

2014-12-17 21:28 GMT+00:00 Aaron Mildenstein aaron@mildensteins.com:

What you're seeing with that error is that the time window selected in
Kibana includes indices which have been marked closed. Elasticsearch is
simply passing on the message, "I can't query that, it's closed" on to
Kibana. It's a non-fatal error.

You can avoid the error by selecting a time window that does not include
closed indices.

--Aaron

On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote:

Hi,

I hope this is the correct group for asking about this behavior, sorry in
advance if it isn't but I would greatly appreciate some help. I'm pretty
new to ElasticSearch itself, currently trying to setup an ELK stack to
analyze a couple of logs.

Recently, I've tried to look around for a mechanism for data retiring and
I started looking into the flush/close/delete options in ES. What I would
like to do ultimately is create a cron job (maybe using Curator[1] for
help) that would close indexes over a couple a days and delete them after a
week. So as a test, I tried closing an index to see what would happen and,
after I closed it, I noticed this error in the Kibana interface:

 Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];]

the same doesn't happen if I simply delete the index. I would like to
continue seeing data from more recent indexes in Kibana, but simply close
older ones. What am I doing wrong? Is there a way for me to keep some older
(Logstash sent) data closed in case I need to open and query it later?

Best regards,

Bruno C.

[1] https://github.com/elasticsearch/curator/

--
You received this message because you are subscribed to a topic in the
Google Groups "elasticsearch" group.
To unsubscribe from this topic, visit
https://groups.google.com/d/topic/elasticsearch/-M76QOyFxS8/unsubscribe.
To unsubscribe from this group and all its topics, send an email to
elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAKEfHmyC-7W7HwtTCK6m_wpT8bg3ReB9ZJEOfpt7vrKnR9X0GA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.