IMO, the _delete_by_query page should mention that if an index is moved out of 'hot' phase by ILM, the delete will fail with "FORBIDDEN/8/index write (api)".
I believe this will depend on how your ILM policy is defined. You have the option to perform a couple of actions that will make the index read-only, but if those steps are avoided it should still be possible to update indices on other tiers.
What does your policy look like?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.