I hope this is the correct group for asking about this behavior, sorry in
advance if it isn't but I would greatly appreciate some help. I'm pretty
new to ElasticSearch itself, currently trying to setup an ELK stack to
analyze a couple of logs.
Recently, I've tried to look around for a mechanism for data retiring and I
started looking into the flush/close/delete options in ES. What I would
like to do ultimately is create a cron job (maybe using Curator[1] for
help) that would close indexes over a couple a days and delete them after a
week. So as a test, I tried closing an index to see what would happen and,
after I closed it, I noticed this error in the Kibana interface:
the same doesn't happen if I simply delete the index. I would like to
continue seeing data from more recent indexes in Kibana, but simply close
older ones. What am I doing wrong? Is there a way for me to keep some older
(Logstash sent) data closed in case I need to open and query it later?
What you're seeing with that error is that the time window selected in
Kibana includes indices which have been marked closed. Elasticsearch is
simply passing on the message, "I can't query that, it's closed" on to
Kibana. It's a non-fatal error.
You can avoid the error by selecting a time window that does not include
closed indices.
--Aaron
On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote:
Hi,
I hope this is the correct group for asking about this behavior, sorry in
advance if it isn't but I would greatly appreciate some help. I'm pretty
new to Elasticsearch itself, currently trying to setup an ELK stack to
analyze a couple of logs.
Recently, I've tried to look around for a mechanism for data retiring and
I started looking into the flush/close/delete options in ES. What I would
like to do ultimately is create a cron job (maybe using Curator[1] for
help) that would close indexes over a couple a days and delete them after a
week. So as a test, I tried closing an index to see what would happen and,
after I closed it, I noticed this error in the Kibana interface:
the same doesn't happen if I simply delete the index. I would like to
continue seeing data from more recent indexes in Kibana, but simply close
older ones. What am I doing wrong? Is there a way for me to keep some older
(Logstash sent) data closed in case I need to open and query it later?
I've since figured out a way to stop that by giving an alias to certain
indexes and only letting Kibana query those. Still, thanks for the help and
the response, hope it will help other people that encounter this error!
What you're seeing with that error is that the time window selected in
Kibana includes indices which have been marked closed. Elasticsearch is
simply passing on the message, "I can't query that, it's closed" on to
Kibana. It's a non-fatal error.
You can avoid the error by selecting a time window that does not include
closed indices.
--Aaron
On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote:
Hi,
I hope this is the correct group for asking about this behavior, sorry in
advance if it isn't but I would greatly appreciate some help. I'm pretty
new to Elasticsearch itself, currently trying to setup an ELK stack to
analyze a couple of logs.
Recently, I've tried to look around for a mechanism for data retiring and
I started looking into the flush/close/delete options in ES. What I would
like to do ultimately is create a cron job (maybe using Curator[1] for
help) that would close indexes over a couple a days and delete them after a
week. So as a test, I tried closing an index to see what would happen and,
after I closed it, I noticed this error in the Kibana interface:
the same doesn't happen if I simply delete the index. I would like to
continue seeing data from more recent indexes in Kibana, but simply close
older ones. What am I doing wrong? Is there a way for me to keep some older
(Logstash sent) data closed in case I need to open and query it later?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.