Logstash is failing with response code 403 (index_closed_exception)

This looks very similar to this topic. Please avoid opening multiple threads for the same issue.

Keeping indices open in order to be able to query and write to them is how it is supposed to work, so I would not classify that as a workaround. It sounds like you may be doing something in a non-optimal way.

What is your sharing strategy as you need to close indices that quickly? How many indices/shards are you creating per day? What is your average shard size?

Why do you have data coming in with such an extreme delay?