You can close an active index in Elasticsearch. Deleting an index removes the entire index and you can never recover it. Closing an index, on the other hand, lets you revive the index on-demand. Closing an index removes the index from memory, but saves it into disk. The cluster overhead it incurs is pretty minimal as only its metadata is maintained in memory. All reads and writes are blocked on a closed index.
You can close an index by executing this :
curl -XPOST 'localhost:9200/my_index/_close'
You can always open it by executing this :
curl -XPOST 'localhost:9200/my_index/_open'
Usecase where this might be useful :
Say you use elasticsearch to index daily logs (like many do). You might maintain per-day indexes as purging becomes easier. If you allow active log search, say for 10 days, you could close all indexes, say for another 10 previous days, and keep it in archived state, just incase it needs to be used. This gives users more flexibility and helps balance capacity in your cluster. You dont have to have 20 day indexes all active at a time, as you only need 10 and you can always bring up an index on demand and close it on demand.