# Logstash is failing with response code 403 trying to publish events to closed filebeat indexes

**URL:** <https://discuss.elastic.co/t/logstash-is-failing-with-response-code-403-trying-to-publish-events-to-closed-filebeat-indexes/112839>\
**Category:** Logstash\
**Created:** [December 21, 2017, 2:37pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-response-code-403-trying-to-publish-events-to-closed-filebeat-indexes/112839 "2017-12-21T14:37:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yuri\_Sibirski](https://avatars.discourse-cdn.com/v4/letter/y/4491bb/32.png) [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\
**Post date:** [December 21, 2017, 2:37pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-response-code-403-trying-to-publish-events-to-closed-filebeat-indexes/112839/1 "2017-12-21T14:37:34Z")

</div>

Dear ELK specialists, for some reason i am seeing my logstash is failing with response code 403 by trying to publish events into closed indexes. Here are some entries from **logstash-plain.log**. Do you have any idea why it is happening and how can i fix it? Opening indexes helps to solve it but it's more like a workaround rather than a fix. I need to close indexes that are older than 2 weeks.

```
[2017-12-21T09:20:18,018][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}
[2017-12-21T09:20:20,022][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"index_closed_exception", "reason"=>"closed", "index_uuid"=>"Laz5seg6R6i45Sjd0v1mKQ", "index"=>"filebeat-2017.09.25"})
[2017-12-21T09:20:20,023][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}
[2017-12-21T09:20:24,028][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"index_closed_exception", "reason"=>"closed", "index_uuid"=>"Laz5seg6R6i45Sjd0v1mKQ", "index"=>"filebeat-2017.09.25"})
[2017-12-21T09:20:24,028][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}
[2017-12-21T09:20:31,979][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"index_closed_exception", "reason"=>"closed", "index_uuid"=>"hMKzRqruTmS63E_NI22D2A", "index"=>"filebeat-2017.09.21"})
[2017-12-21T09:20:31,979][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}
[2017-12-21T09:20:32,035][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"index_closed_exception", "reason"=>"closed", "index_uuid"=>"Laz5seg6R6i45Sjd0v1mKQ", "index"=>"filebeat-2017.09.25"})
[2017-12-21T09:20:32,035][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 21, 2017, 7:33pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-response-code-403-trying-to-publish-events-to-closed-filebeat-indexes/112839/2 "2017-12-21T19:33:19Z")

</div>

Why do you need to close indices older than 2 weeks? How come you have data coming in with such a delay?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2018, 7:33pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-response-code-403-trying-to-publish-events-to-closed-filebeat-indexes/112839/3 "2018-01-18T19:33:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.