Index_closed_exception

Elastic Stack Elasticsearch
1

I'm seeing unexpected behavior since upgrading elasticsearch to 2.1 and kibana to 4.3. Looks like the field stats api is now being used by kibana to determine which indices to query. The following request to _field_stats?level=indices (past 7 days):

{
  "fields": [
    "@timestamp"
  ],
  "index_constraints": {
    "@timestamp": {
      "max_value": {
        "gte": 1451407412544,
        "format": "epoch_millis"
      },
      "min_value": {
        "lte": 1452012212544,
        "format": "epoch_millis"
      }
    }
  }
}

Produces this response from elasticsearch:

{
  "error": {
    "root_cause": [
      {
        "type": "index_closed_exception",
        "reason": "closed",
        "index": "logstash-2015.10.06"
      }
    ],
    "type": "index_closed_exception",
    "reason": "closed",
    "index": "logstash-2015.10.06"
  },
  "status": 403
}

After I open the indices that elasticsearch complains are closed, the field stats response doesn't even contain those indices. Is this a bug?

{
  "_shards": {
    "total": 294,
    "successful": 294,
    "failed": 0
  },
  "indices": {
    "logstash-2016.01.01": {
      "fields": {
        "@timestamp": {
          "max_doc": 16006858,
          "doc_count": 16006858,
          "density": 100,
          "sum_doc_freq": 64027432,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-01T00:00:00.000Z",
          "max_value": "2016-01-01T23:59:59.988Z"
        }
      }
    },
    "logstash-2016.01.04": {
      "fields": {
        "@timestamp": {
          "max_doc": 15161671,
          "doc_count": 15161671,
          "density": 100,
          "sum_doc_freq": 60646684,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-04T00:00:00.000Z",
          "max_value": "2016-01-04T23:59:59.999Z"
        }
      }
    },
    "logstash-2016.01.05": {
      "fields": {
        "@timestamp": {
          "max_doc": 9857789,
          "doc_count": 9857789,
          "density": 100,
          "sum_doc_freq": 39431156,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-05T00:00:00.000Z",
          "max_value": "2016-01-05T16:56:25.534Z"
        }
      }
    },
    "logstash-2016.01.02": {
      "fields": {
        "@timestamp": {
          "max_doc": 16221172,
          "doc_count": 16221172,
          "density": 100,
          "sum_doc_freq": 64884688,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-02T00:00:00.000Z",
          "max_value": "2016-01-02T23:59:59.989Z"
        }
      }
    },
    "logstash-2016.01.03": {
      "fields": {
        "@timestamp": {
          "max_doc": 16289083,
          "doc_count": 16289083,
          "density": 100,
          "sum_doc_freq": 65156332,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-03T00:00:00.006Z",
          "max_value": "2016-01-03T23:59:59.997Z"
        }
      }
    },
    "logstash-2015.12.29": {
      "fields": {
        "@timestamp": {
          "max_doc": 14644237,
          "doc_count": 14644237,
          "density": 100,
          "sum_doc_freq": 58576948,
          "sum_total_term_freq": -1,
          "min_value": "2015-12-29T00:00:00.004Z",
          "max_value": "2015-12-29T23:59:59.975Z"
        }
      }
    },
    "logstash-2015.12.30": {
      "fields": {
        "@timestamp": {
          "max_doc": 15806313,
          "doc_count": 15806313,
          "density": 100,
          "sum_doc_freq": 63225252,
          "sum_total_term_freq": -1,
          "min_value": "2015-12-30T00:00:00.000Z",
          "max_value": "2015-12-30T23:59:59.977Z"
        }
      }
    },
    "logstash-2015.12.31": {
      "fields": {
        "@timestamp": {
          "max_doc": 15882790,
          "doc_count": 15882790,
          "density": 100,
          "sum_doc_freq": 63531160,
          "sum_total_term_freq": -1,
          "min_value": "2015-12-31T00:00:00.000Z",
          "max_value": "2015-12-31T23:59:59.994Z"
        }
      }
    }
  }
}

Thanks!

2

In case anyone else experiences this, the problem was that aliases existed for the closed indices and the aliases get picked up by the wildcard pattern used in the _field_stats call.

1 Like