# Index\_closed\_exception

**URL:** <https://discuss.elastic.co/t/index-closed-exception/38424>\
**Category:** Elasticsearch\
**Created:** [January 5, 2016, 5:02pm UTC](https://discuss.elastic.co/t/index-closed-exception/38424 "2016-01-05T17:02:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\
**Post date:** [January 5, 2016, 5:02pm UTC](https://discuss.elastic.co/t/index-closed-exception/38424/1 "2016-01-05T17:02:16Z")

</div>

I'm seeing unexpected behavior since upgrading elasticsearch to 2.1 and kibana to 4.3. Looks like the field stats api is now being used by kibana to determine which indices to query. The following request to `_field_stats?level=indices` (past 7 days):

```auto
{
  "fields": [
    "@timestamp"
  ],
  "index_constraints": {
    "@timestamp": {
      "max_value": {
        "gte": 1451407412544,
        "format": "epoch_millis"
      },
      "min_value": {
        "lte": 1452012212544,
        "format": "epoch_millis"
      }
    }
  }
}

```

Produces this response from elasticsearch:

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "index_closed_exception",
        "reason": "closed",
        "index": "logstash-2015.10.06"
      }
    ],
    "type": "index_closed_exception",
    "reason": "closed",
    "index": "logstash-2015.10.06"
  },
  "status": 403
}

```

After I open the indices that elasticsearch complains are closed, the field stats response doesn't even contain those indices. Is this a bug?

```auto
{
  "_shards": {
    "total": 294,
    "successful": 294,
    "failed": 0
  },
  "indices": {
    "logstash-2016.01.01": {
      "fields": {
        "@timestamp": {
          "max_doc": 16006858,
          "doc_count": 16006858,
          "density": 100,
          "sum_doc_freq": 64027432,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-01T00:00:00.000Z",
          "max_value": "2016-01-01T23:59:59.988Z"
        }
      }
    },
    "logstash-2016.01.04": {
      "fields": {
        "@timestamp": {
          "max_doc": 15161671,
          "doc_count": 15161671,
          "density": 100,
          "sum_doc_freq": 60646684,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-04T00:00:00.000Z",
          "max_value": "2016-01-04T23:59:59.999Z"
        }
      }
    },
    "logstash-2016.01.05": {
      "fields": {
        "@timestamp": {
          "max_doc": 9857789,
          "doc_count": 9857789,
          "density": 100,
          "sum_doc_freq": 39431156,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-05T00:00:00.000Z",
          "max_value": "2016-01-05T16:56:25.534Z"
        }
      }
    },
    "logstash-2016.01.02": {
      "fields": {
        "@timestamp": {
          "max_doc": 16221172,
          "doc_count": 16221172,
          "density": 100,
          "sum_doc_freq": 64884688,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-02T00:00:00.000Z",
          "max_value": "2016-01-02T23:59:59.989Z"
        }
      }
    },
    "logstash-2016.01.03": {
      "fields": {
        "@timestamp": {
          "max_doc": 16289083,
          "doc_count": 16289083,
          "density": 100,
          "sum_doc_freq": 65156332,
          "sum_total_term_freq": -1,
          "min_value": "2016-01-03T00:00:00.006Z",
          "max_value": "2016-01-03T23:59:59.997Z"
        }
      }
    },
    "logstash-2015.12.29": {
      "fields": {
        "@timestamp": {
          "max_doc": 14644237,
          "doc_count": 14644237,
          "density": 100,
          "sum_doc_freq": 58576948,
          "sum_total_term_freq": -1,
          "min_value": "2015-12-29T00:00:00.004Z",
          "max_value": "2015-12-29T23:59:59.975Z"
        }
      }
    },
    "logstash-2015.12.30": {
      "fields": {
        "@timestamp": {
          "max_doc": 15806313,
          "doc_count": 15806313,
          "density": 100,
          "sum_doc_freq": 63225252,
          "sum_total_term_freq": -1,
          "min_value": "2015-12-30T00:00:00.000Z",
          "max_value": "2015-12-30T23:59:59.977Z"
        }
      }
    },
    "logstash-2015.12.31": {
      "fields": {
        "@timestamp": {
          "max_doc": 15882790,
          "doc_count": 15882790,
          "density": 100,
          "sum_doc_freq": 63531160,
          "sum_total_term_freq": -1,
          "min_value": "2015-12-31T00:00:00.000Z",
          "max_value": "2015-12-31T23:59:59.994Z"
        }
      }
    }
  }
}

```

Thanks!

---

<div class="post-metadata">

**Author:** ![erikstephens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikstephens/32/5430_2.png) [@erikstephens](https://discuss.elastic.co/u/erikstephens)\
**Post date:** [February 1, 2016, 11:03pm UTC](https://discuss.elastic.co/t/index-closed-exception/38424/2 "2016-02-01T23:03:35Z")

</div>

In case anyone else experiences this, the problem was that aliases existed for the closed indices and the aliases get picked up by the wildcard pattern used in the \_field\_stats call.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:19pm UTC](https://discuss.elastic.co/t/index-closed-exception/38424/3 "2017-07-05T23:19:50Z")

</div>