Hey Aaron,
I've since figured out a way to stop that by giving an alias to certain
indexes and only letting Kibana query those. Still, thanks for the help and
the response, hope it will help other people that encounter this error!
Merry Christmas, cheers!
Bruno Cruz
2014-12-17 21:28 GMT+00:00 Aaron Mildenstein :
>
> What you're seeing with that error is that the time window selected in
> Kibana includes indices which have been marked closed. Elasticsearch is
> simply passing on the message, "I can't query that, it's closed" on to
> Kibana. It's a non-fatal error.
>
> You can avoid the error by selecting a time window that does not include
> closed indices.
>
> --Aaron
>
>
>
> On Thursday, November 27, 2014 7:47:31 AM UTC-7, Bruno Cruz wrote:
>>
>> Hi,
>>
>> I hope this is the correct group for asking about this behavior, sorry in
>> advance if it isn't but I would greatly appreciate some help. I'm pretty
>> new to ElasticSearch itself, currently trying to setup an ELK stack to
>> analyze a couple of logs.
>>
>> Recently, I've tried to look around for a mechanism for data retiring and
>> I started looking into the flush/close/delete options in ES. What I would
>> like to do ultimately is create a cron job (maybe using Curator[1] for
>> help) that would close indexes over a couple a days and delete them after a
>> week. So as a test, I tried closing an index to see what would happen and,
>> after I closed it, I noticed this error in the Kibana interface:
>>
>> Oops! ClusterBlockException[blocked by: [FORBIDDEN/4/index closed];]
>>
>> the same doesn't happen if I simply delete the index. I would like to
>> continue seeing data from more recent indexes in Kibana, but simply close
>> older ones. What am I doing wrong? Is there a way for me to keep some older
>> (Logstash sent) data closed in case I need to open and query it later?
>>
>> Best regards,
>>
>> Bruno C.
>>
>>
>> [1] https://github.com/elasticsearch/curator/
>>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "elasticsearch" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/elasticsearch/-M76QOyFxS8/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> elasticsearch+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com
> <https://groups.google.com/d/msgid/elasticsearch/1403fe33-7b6b-42a7-90cd-27592b25aa53%40googlegroups.com?utm_medium=email&utm_source=footer>
> .
> For more options, visit https://groups.google.com/d/optout.
>
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to elasticsearch+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAKEfHmyC-7W7HwtTCK6m_wpT8bg3ReB9ZJEOfpt7vrKnR9X0GA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
