Recreating an index re-associate the data?

[ZillaG]

ES v2.4.x

I've read posts in the forum discouraging users from opening currently closed indices, and to delete and recreate the index as the preferred way. If I recreate an index, will it be associated with the data it was originally created for?

For example I create a daily index of our logs

logstash-customer-2017.03.13
logstash-customer-2017.03.14
logstash-customer-2017.03.15

I can then view the logs I want in Kibana based on the date.

Now if I delete logstash-customer-2017.03.13 and re-create it, how do the 2017.03.13 logs get re-associated with that index?

I hope the question makes sense.

Thanks

[Cylindric (Mark Hanford)]

If you delete it, you lose the data. Do you have any links to this advice? I wonder if they were talking about something slightly different.

[ZillaG]

Look at some of the comments in Open closed index automatically

[Cylindric (Mark Hanford)]

I'm not sure why @dadoonet thinks opening an existing index with lots of data in it is in any way comparable to creating a new index. It's fairly clear to me that in the first case, you want to keep that data and are prepared to suck up the overhead.

Also, he says it is slower, so it's not done automatically, not that you should never do it. I guess if they auto-opened, you would get all sorts of unexpected load spikes. That other question is a about "automatically reopening closed indices" - a totally different proposition.

[ZillaG]

No, I don't want to "automatically open closed index" but I want to manually open one. @dadoonet's remarks in that post just caught my attentions.

[Cylindric (Mark Hanford)]

I would monitor the effect of opening those indices on your cluster, but if you need that data, you need it.