Briefly, this error occurs when Elasticsearch tries to perform operations on source indices that have been deleted or closed. This could be due to a misconfiguration or an accidental deletion. To resolve this issue, you can either reopen the closed indices using the ‘open index’ API, or recreate the deleted indices. Ensure that the indices are properly configured and protected to prevent accidental deletion or closure in the future. Also, regularly monitor your Elasticsearch cluster to detect any anomalies early.
This guide will help you check for common problems that cause the log ” Source indices have been deleted or closed. ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin, source, indices.
Overview
When a document is sent for indexing, Elasticsearch indexes all the fields in the format of an inverted index, but it also keeps the original JSON document in a special field called _source.
Examples
Disabling source field in the index:
PUT /api-logs?pretty
{
"mappings": {
"_source": {
"enabled": false
}
}
}Store only selected fields as a part of _source field:
PUT api-logs
{
"mappings": {
"_source": {
"includes": [
"*.count",
"error_info.*"
],
"excludes": [
"error_info.traceback_message"
]
}
}
}Including only selected fields using source filtering:
GET api-logs/_search
{
"query": {
"match_all": {}
},
"_source": {
"includes": ["api_name","status_code", "*id"]
}
}Notes
The source field brings an overhead of extra storage space but serves special purposes such as:
- Return as a part of the response when a search query is executed.
- Used for reindexing purpose, update and update_by_query operations.
- Used for highlighting, if the field is not stored, it means the field is not set as “store to true” inside the mapping.
- Allows selection of fields to be returned.
The only concern with source field is the extra storage usage on disk. But this storage space used by source field can be optimized by changing compression level to best_compression. This setting is done using index.codec parameter.
Log Context
Log “Source indices have been deleted or closed.” class name is AbstractCompositeAggFunction.java. We extracted the following from Elasticsearch source code for those seeking an in-depth context :
ActionListener.wrap(r -> {
try {
final Aggregations aggregations = r.getAggregations();
if (aggregations == null) {
listener.onFailure(
new ElasticsearchStatusException("Source indices have been deleted or closed."; RestStatus.BAD_REQUEST)
);
return;
}
final CompositeAggregation agg = aggregations.get(COMPOSITE_AGGREGATION_NAME);
if (agg == null || agg.getBuckets().isEmpty()) {
