Attempting to delete by query events in a frozen data tier index belonging to a data stream. I've tried targeting the specific index the events are in as well as the datastream name, but I get the following error:
"reason": "index [partial.contoso-2023.10.19-000147] blocked by: [FORBIDDEN/8/index write (api)];"
For this to work, you will need to remount the index without write blocked.
This is by design as cold and frozen are meant as archival (read only).
If you really need to remove the data, my approach would be to reindex the data by query (excluding the data you need to remove) and then delete the source index.
Thanks @sholzhauer! Mind double-checking my work, will the source index still be picked up properly by the data stream? My query should exclude all documents where the field
will the source index still be picked up properly by the data stream
If you are referring to the Data View in kibana, then yes it should be picked up.
But it will not be a part of the same datastream.
If you want it to be a part of the same datastream you should replace your
dest configuration with the datastream name.
My query should exclude all documents where the field
Then yes your query looks to be doing precisely that.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.