FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
FortiKoala
Staff
Staff
Article Id 190848
Description

How to close, open (and delete) Elasticsearch indices using the head plugin


Scope

FAQ


Solution

The version of Elasticsearch used by ZoneFox v3.2 onwards no longer supports the use of the * wildcard (or _all) for actioning multiple indices simultaneously.  Therefore every index needs to be actioned individually.


The following instructions show how this can be done using the head plugin.


  1. Connect to your Elasticsearch instance using the head plugin  (e.g http://db.zonefox.example.com:9200/_plugin/head)
  2. On the Overview tab, scroll horizontally to find the required index
  3. The index can be opened, closed and deleted via the Actions menu:



An alternative method, also in head is


  1. Connect to your Elasticsearch instance using the head plugin  (e.g http://db.zonefox.example.com:9200/_plugin/head)
  2. Go to the Any Request tab
  3. Add the index name to the path to your database, e.g http://db.zonefox.example.com:9200/events.usr.2017.04
  4. Enter the command:   _close  (or _open)
  5. Choose POST from the dropdown list
  6. Click on the Request button

  7. Edit the index name to repeat the process for other indices, e.g events.usr.2017.04, events.usr.2017.05, events.usr.2017.06, events.usr.2017.07



Additionally, if you want to delete indices, as above but

  1. Delete any command
  2. Choose DELETE from the dropdown list
  3. Click on the Request button




Contributors