Kibana4, no message querying closed indices

Elastic Stack Kibana
1

Hey guys,

First off, we use Kibana 4.6.0 (and no we dont upgrade to 5.x in the near future :slight_smile: )
we are using daily time-based indices in our ES-cluster where we close the oldest ones to save some heap memory.

Today one of my colleagues did a query 3 months in the past and wondered that he got no results.

As i looked in our cluster, 1 month of the data were in closed indicies, so we were very surprised that Kibana dont show any "critical error" message when u query closed indices, since this leads to the assumtion that there is no data for the user, while it is only in closed indices.

Is this expected behaviour for this version of Kibana or some kind of bug?

Any feedback is appreciated.

2

Closed indices are not available to the cluster. They sit on disk but as they are not open and online, they are not considered for querying, so what you see is expected. This behaviour has not changed in 5.x.

3

Thanks for pointing this out again in case someone is not too familiar with closing indicies.

What bothers me however is that there is no "could not find any suitable index for your query" kind of message (like u get when u query a non-existent index in ES), a user can not know that the admin is closing old indices, thus he gets no results and think that Kibana/the application is broken.

As someone that wants to fetch data there is no difference between an closed or an non-existent index.

Should i go on and make a thread on github about this or was this already discussed?

4

One of the issues with closed indices, and the reason why I rarely recommend it, is that the closed indices are not managed by the cluster. If you have a encounter hardware problems and e.g. replace disks or nodes, Elasticsearch does not move closed indices around or ensure that there always exist at least one replica. If you have several hardware failures, affecting both the primary and corresponding replica shard, it can lead to silent data loss.

I am not sure whether there exists any issue on GitHub, so have a look around and feel free to create one to start a discussion if there isn't.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.