No document in index, but index stats reports numerous docs

[zarak]

Hi !

I have an index that reports me some documents in Kibana in Index management, as well as in its stats:

GET /v2-logs-000003/_stats
    {
      "_shards" : {
        "total" : 6,
        "successful" : 6,
        "failed" : 0
      },
      "_all" : {
        "primaries" : {
          "docs" : {
            "count" : 19430,
            "deleted" : 0
          },
          "store" : {
            "size_in_bytes" : 4533561,
            "reserved_in_bytes" : 0
          },
[truncated]

However, I can't find the documents in it:

GET /v2-logs-000003/_search
    {
      "query": {
        "match_all": {}
      }
    }

returns

    {
      "took" : 0,
      "timed_out" : false,
      "_shards" : {
        "total" : 0,
        "successful" : 0,
        "skipped" : 0,
        "failed" : 0
      },
      "hits" : {
        "total" : {
          "value" : 0,
          "relation" : "eq"
        },
        "max_score" : 0.0,
        "hits" : [ ]
      }
    }

Am I missing something ?

Thanks for your help

[Miguel1 (Miguel)]

Maybe the index is not refreshed yet ( https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-refresh.html ).

[zarak]

I just tried refresh-ing it, but it didn't solve the issue. The index is frozen, if that changes anything

EDIT: ok so apparently if an index is frozen, it's not searchable anymore, not directly, and needs to be unfreeze. I wasn't aware of that

[Miguel1 (Miguel)]

You have to use ignore_throttled=false, if you want to include frozen indices. It is intended to avoid querying any kind of index and getting slower responses.

GET /v2-logs-000003/_search?ignore_throttled=false
    {
      "query": {
        "match_all": {}
      }
    }

[zarak]

Ok, thank you for your response !