# Logstash and frozen index

**URL:** <https://discuss.elastic.co/t/logstash-and-frozen-index/256593>\
**Category:** Logstash\
**Created:** [November 25, 2020, 3:26am UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593 "2020-11-25T03:26:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mcantin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mcantin/32/79651_2.png) [@mcantin](https://discuss.elastic.co/u/mcantin)\
**Post date:** [November 25, 2020, 3:26am UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593/1 "2020-11-25T03:26:39Z")

</div>

Hi,  
Last week, I froze old indexes (over a month). Everything worked and elasticsearch was faster. But since monday we have this error in loop in Logstash:

> [2020-11-24T15:29:42,146][INFO][logstash.outputs.elasticsearch][beat][b3794bbce4619b8fac89bacc6a147632a21dd948445953c7961c6c4986ea2a65] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index [filebeat-redis-2020.34] blocked by: [FORBIDDEN/8/index write (api)];"})

There are no new logs. I understand that logstash is trying to create a new index since the index pattern is weekly, but I don't understand why it is trying to modify the old indexes.

Of course, I fix this by unfreezing the indexes. But I don't understand why. Is the freeze indexes a good practices? Is there a way to use logstash and frozen indexes?

edit: I use elasticsearch, logstash and kibana in version 7.9.2

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 25, 2020, 5:20am UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593/2 "2020-11-25T05:20:06Z")

</div>

Welcome to our community! 😃

> [@mcantin](#):
>
> filebeat-redis-2020.34

Are you using weekly indices?  
It could be that Logstash thinks it has an event from that week that it needs to index it.

---

<div class="post-metadata">

**Author:** ![mcantin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mcantin/32/79651_2.png) [@mcantin](https://discuss.elastic.co/u/mcantin)\
**Post date:** [November 25, 2020, 2:57pm UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593/3 "2020-11-25T14:57:25Z")

</div>

Yes, we use weekly indices. When does logstash decide to log to an old index?

---

<div class="post-metadata">

**Author:** ![mcantin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mcantin/32/79651_2.png) [@mcantin](https://discuss.elastic.co/u/mcantin)\
**Post date:** [November 26, 2020, 5:01pm UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593/4 "2020-11-26T17:01:26Z")

</div>

I'm doing more testing and I'm pretty sure it's not old logs in old indexes.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 30, 2020, 4:23am UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593/5 "2020-11-30T04:23:19Z")

</div>

What does your Logstash config look like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2020, 4:23am UTC](https://discuss.elastic.co/t/logstash-and-frozen-index/256593/6 "2020-12-28T04:23:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.