Hello everyone
I was trying to apply a case to elasticsearch by manipulating the index.block.read settings.
The idea is the following, as long as the logstash is loading data into a new index, this index remains blocked and those already in elk remain normal, I only release the reading for this new index when the load is completely complete. So far so good, for this part I applied the index setting directly in the template.
The problem is when I'm going to do a query on elasticsearch.
Example:
I have two index index- {yyyy.mm.today} and index- {yyyy.mm.yesterday} and my query is something like index - * / _ search {query}. I wanted to make sure that in this query where I'm using the regex * it ignores the index that was with block.read = true. Currently when I try this a 403 forbidden is returned because one of them is blocked, but the other is not.
Is it possible to make the query identify and read only those indexes that do not have block.read = true?
Thank you!