# ClusterBlockException after closing an index **URL:** \ **Category:** Elasticsearch\ **Created:** [November 27, 2014, 2:47pm UTC](https://discuss.elastic.co/t/clusterblockexception-after-closing-an-index/20972 "2014-11-27T14:47:31Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Bruno\_Cruz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_cruz/32/1044_2.png) [@Bruno\_Cruz](https://discuss.elastic.co/u/Bruno_Cruz)\ **Post date:** [November 27, 2014, 2:47pm UTC](https://discuss.elastic.co/t/clusterblockexception-after-closing-an-index/20972/1 "2014-11-27T14:47:31Z")
Hi, I hope this is the correct group for asking about this behavior, sorry in advance if it isn't but I would greatly appreciate some help. I'm pretty new to ElasticSearch itself, currently trying to setup an ELK stack to analyze a couple of logs. Recently, I've tried to look around for a mechanism for data retiring and I started looking into the flush/close/delete options in ES. What I would like to do ultimately is create a cron job (maybe using Curator[1] for help) that would close indexes over a couple a days and delete them after a week. So as a test, I tried closing an index to see what would happen and, after I closed it, I noticed this error in the Kibana interface: ``` Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];] ``` the same doesn't happen if I simply delete the index. I would like to continue seeing data from more recent indexes in Kibana, but simply close older ones. What am I doing wrong? Is there a way for me to keep some older (Logstash sent) data closed in case I need to open and query it later? Best regards, Bruno C. [1] [https://github.com/elasticsearch/curator/](https://github.com/elasticsearch/curator/) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/609afd12-b257-4a06-b690-88a1f9ed027f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/609afd12-b257-4a06-b690-88a1f9ed027f%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [December 17, 2014, 9:28pm UTC](https://discuss.elastic.co/t/clusterblockexception-after-closing-an-index/20972/2 "2014-12-17T21:28:05Z")
What you're seeing with that error is that the time window selected in Kibana includes indices which have been marked closed. Elasticsearch is simply passing on the message, "I can't query that, it's closed" on to Kibana. It's a non-fatal error. You can avoid the error by selecting a time window that does not include closed indices. --Aaron On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote: > Hi, > > I hope this is the correct group for asking about this behavior, sorry in > advance if it isn't but I would greatly appreciate some help. I'm pretty > new to Elasticsearch itself, currently trying to setup an ELK stack to > analyze a couple of logs. > > Recently, I've tried to look around for a mechanism for data retiring and > I started looking into the flush/close/delete options in ES. What I would > like to do ultimately is create a cron job (maybe using Curator[1] for > help) that would close indexes over a couple a days and delete them after a > week. So as a test, I tried closing an index to see what would happen and, > after I closed it, I noticed this error in the Kibana interface: > > ``` > Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];] > > ``` > > the same doesn't happen if I simply delete the index. I would like to > continue seeing data from more recent indexes in Kibana, but simply close > older ones. What am I doing wrong? Is there a way for me to keep some older > (Logstash sent) data closed in case I need to open and query it later? > > Best regards, > > Bruno C. > > [1] [GitHub - elastic/curator: Curator: Tending your Elasticsearch indices](https://github.com/elasticsearch/curator/) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Bruno\_Cruz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_cruz/32/1044_2.png) [@Bruno\_Cruz](https://discuss.elastic.co/u/Bruno_Cruz)\ **Post date:** [December 18, 2014, 10:32am UTC](https://discuss.elastic.co/t/clusterblockexception-after-closing-an-index/20972/3 "2014-12-18T10:32:05Z")
Hey Aaron, I've since figured out a way to stop that by giving an alias to certain indexes and only letting Kibana query those. Still, thanks for the help and the response, hope it will help other people that encounter this error! Merry Christmas, cheers! Bruno Cruz 2014-12-17 21:28 GMT+00:00 Aaron Mildenstein [aaron@mildensteins.com](mailto:aaron@mildensteins.com): > What you're seeing with that error is that the time window selected in > Kibana includes indices which have been marked closed. Elasticsearch is > simply passing on the message, "I can't query that, it's closed" on to > Kibana. It's a non-fatal error. > > You can avoid the error by selecting a time window that does not include > closed indices. > > --Aaron > > On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote: > > > Hi, > > > > I hope this is the correct group for asking about this behavior, sorry in > > advance if it isn't but I would greatly appreciate some help. I'm pretty > > new to Elasticsearch itself, currently trying to setup an ELK stack to > > analyze a couple of logs. > > > > Recently, I've tried to look around for a mechanism for data retiring and > > I started looking into the flush/close/delete options in ES. What I would > > like to do ultimately is create a cron job (maybe using Curator[1] for > > help) that would close indexes over a couple a days and delete them after a > > week. So as a test, I tried closing an index to see what would happen and, > > after I closed it, I noticed this error in the Kibana interface: > > > > ``` > > Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];] > > > > ``` > > > > the same doesn't happen if I simply delete the index. I would like to > > continue seeing data from more recent indexes in Kibana, but simply close > > older ones. What am I doing wrong? Is there a way for me to keep some older > > (Logstash sent) data closed in case I need to open and query it later? > > > > Best regards, > > > > Bruno C. > > > > [1] [GitHub - elastic/curator: Curator: Tending your Elasticsearch indices](https://github.com/elasticsearch/curator/) > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/-M76QOyFxS8/unsubscribe](https://groups.google.com/d/topic/elasticsearch/-M76QOyFxS8/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAKEfHmyC-7W7HwtTCK6m\_wpT8bg3ReB9ZJEOfpt7vrKnR9X0GA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAKEfHmyC-7W7HwtTCK6m_wpT8bg3ReB9ZJEOfpt7vrKnR9X0GA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:42am UTC](https://discuss.elastic.co/t/clusterblockexception-after-closing-an-index/20972/4 "2017-07-06T00:42:56Z")