# System indices closed, not able to do anything
**URL:** https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725
**Category:** Elasticsearch
**Created:** [June 3, 2024, 2:47pm UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725 "2024-06-03T14:47:35Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@albertino87](https://discuss.elastic.co/u/albertino87)
#### Post date: [June 3, 2024, 2:47pm UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/1 "2024-06-03T14:47:35Z")
Hi,
by mistake I closed all the indices (even the system indices) of my cluster and now i cannot do anything, not even log into kibana or open them with curl, the credentials (even if correct) are not recognized. how can i re-open the indices?
---
### Author:  [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)
#### Post date: [June 3, 2024, 3:35pm UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/2 "2024-06-03T15:35:32Z")
Hi Albe.
Does Elasticsearch properly start for you still?
If so, you can try configuring [File-based authentication](https://www.elastic.co/guide/en/elasticsearch/reference/current/file-realm.html) and using these credentials to run `POST /_all/open` with curl.
---
### Author:  [@albertino87](https://discuss.elastic.co/u/albertino87)
#### Post date: [June 4, 2024, 7:24am UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/4 "2024-06-04T07:24:07Z")
Hi Artem,
I tried to follow your suggestion, I added a user with:
```auto
usr/share/elasticsearch/bin/elasticsearch-users useradd testelastic -p ******** -r manage,all
```
but i get this warning:
```auto
Warning: The following roles [all,manage] are not in the [/etc/elasticsearch/roles.yml] file. Make sure the names are correct. If the names are correct and t
he roles were created using the API please disregard this message. Nonetheless the user will still be associated with all specified roles
Known roles: [kibana_dashboard_only_user, apm_system, watcher_admin, viewer, logstash_system, rollup_user, kibana_user, beats_admin, remote_monitoring_agent,
rollup_admin, data_frame_transforms_admin, snapshot_user, monitoring_user, enrich_user, kibana_admin, logstash_admin, editor, machine_learning_user, data_fr
ame_transforms_user, machine_learning_admin, watcher_user, apm_user, beats_system, reporting_user, transform_user, kibana_system, transform_admin, transport_
client, remote_monitoring_collector, superuser, ingest_admin]
```
at the same time when i call the command to open the indices:
```auto
curl -X POST "
https://10.145.26.39:9200/_all/_open?pretty" -k -u testelastic: ******
```
I get:
```auto
{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "action [indices:admin/open] is unauthorized for user [testelastic] with roles [all,manage], this action is granted by the index privilege
s [manage,all]"
}
],
"type" : "security_exception",
"reason" : "action [indices:admin/open] is unauthorized for user [testelastic] with roles [all,manage], this action is granted by the index privileges [manage,all]"
},
"status" : 403
}
```
how can i fix this?
Many thanks
Albe
---
### Author:  [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)
#### Post date: [June 4, 2024, 8:09am UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/5 "2024-06-04T08:09:58Z")
Hi Albe,
I see that this user at least has access to the indices, so it's a good start.
What if you assign a `superuser` role to this user and try to open the indices?
---
### Author:  [@albertino87](https://discuss.elastic.co/u/albertino87)
#### Post date: [June 4, 2024, 9:27am UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/6 "2024-06-04T09:27:23Z")
I tried but i get this:
```auto
{
"error" : {
"root_cause" : [
{
"type" : "cluster_block_exception",
"reason" : "index [xxxxxxxxxxxx] blocked by: [FORBIDDEN/6/cluster read-only (api)];index [yyyyyyyyyyyyyyy] blocked by: [FORBIDDEN/6/cluster read-only (ap
i)];index [.monitoring-es-7-2024.05.27] blocked by: [FORBIDDEN/6/cluster read-only (api)];................................."
}
],
"type" : "cluster_block_exception",
"reason" : "index [xxxxxxxxxxxx] blocked by: [FORBIDDEN/6/cluster read-only (api)];index [yyyyyyyyyyyyyyy] blocked by: [FORBIDDEN/6/cluster read-only (ap
i)];index [.monitoring-es-7-2024.05.27] blocked by: [FORBIDDEN/6/cluster read-only (api)];................................."
},
"status" : 403
}
```
---
### Author:  [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)
#### Post date: [June 4, 2024, 10:27am UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/7 "2024-06-04T10:27:26Z")
Is your cluster in read-only state too?
If so, you can turn the read-only state off by executing this query:
```auto
PUT /_cluster/settings
{
"persistent" : {
"cluster.blocks.read_only" : false
}
}
```
Also if you have fresh backups of your cluster, rolling back to a fresh backup might be a good last resort option.
---
### Author:  [@albertino87](https://discuss.elastic.co/u/albertino87)
#### Post date: [June 4, 2024, 11:04am UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/8 "2024-06-04T11:04:34Z")
Hi Artem, it was as you said, it was in read only too. now i was able to fix it.
many thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 2, 2024, 11:05am UTC](https://discuss.elastic.co/t/system-indices-closed-not-able-to-do-anything/360725/9 "2024-07-02T11:05:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.