Index_closed_exception on open index

Elastic Stack Elasticsearch
1

Hi,

We currently have a cluster with a lot of network security (Zeek) logs. I have a script written with elasticsearch-py which periodically searches all data for known IOCs (bad IPs, bad domains, etc.)

Every once in a while, the script crashes because Elasticsearch is returning an index_closed_exception. If I check alter with the "cat indices" API, the index shows as open.

We have an ILM in place which freezes indices older than 14 days, but it never closes them.

Could this be related to the ILM? Does it temporarily close an index when rotating or something?

2

It does not.

What is the actual response you get from Elasticsearch? Is there anything in the Elasticsearch logs that aligns with the timing of the issue?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.