Closing and opening indexes in Elasticsearch

You can close an active index in Elasticsearch. Deleting an index removes the entire index and you can never recover it. Closing an index, on the other hand, lets you revive the index on-demand. Closing an index removes the index from memory, but saves it into disk. The cluster overhead it incurs is pretty minimal as only its metadata is maintained in memory. All reads and writes are blocked on a closed index.

You can close an index by executing this :

curl -XPOST 'localhost:9200/my_index/_close'

You can always open it by executing this :

curl -XPOST 'localhost:9200/my_index/_open'


Usecase where this might be useful :

Say you use elasticsearch to index daily logs (like many do). You might maintain per-day indexes as purging becomes easier. If you allow active log search, say for 10 days, you could close all indexes, say for another 10 previous days, and keep it in archived state, just incase it needs to be used. This gives users more flexibility and helps balance capacity in your cluster. You dont have to have 20 day indexes all active at a time, as you only need 10 and you can always bring up an index on demand and close it on demand.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s