Data disappeared but _stats doesn't say the same

Elastic Stack Elasticsearch
1

Hello,

I just noticed that my data before April 1 has disappeared. I have one index per month, and the indexes 2019.03 and below no longer return documents.
When I do a _search or _count, the return gives me :

{
  "count" : 0,
  "_shards" : {
    "total" : 0,
    "successful" : 0,
    "skipped" : 0,
    "failed" : 0
  }
}

While, when I do a _stats on the same index, I have :

  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "failed" : 0
  },
  "_all" : {
    "primaries" : {
      "docs" : {
        "count" : 44468116,
        "deleted" : 0
      },
      "store" : {
        "size_in_bytes" : 6048538346
      }

With the _cat/shards request, my shards seem to be well assigned

shrink-index-2019.03             0 p STARTED  44468116   5.6gb 10.244.8.6  elasticsearch-data-1
shrink-index-2019.03             0 r STARTED  44468116   5.6gb 10.244.4.5  elasticsearch-data-2

As you can see, the indexes are managed by a lifecycle policy index, and have been shrink. But the 2019.04 index, on which data is still accessible, has also been shrink.

2

Ok some news : I unfrozen the index and now it's readable. I don't get why when it's frozen, I can't read the data. Did I miss something ?

3

Did you pass the ?ignore_throttled=false parameter to your search?

By default frozen indices are not searched since they are much slower to search than non-frozen indices.

4

Thank you ! I misinterpreted the documentation ...

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.