Deleting and closing indexes in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does it mean to delete an index in Elasticsearch?

Deleting an index means permanently removing the index and all its data from Elasticsearch. This action cannot be undone.

beginner

What is the difference between closing and deleting an index?

Closing an index makes it unavailable for search and indexing but keeps its data on disk. Deleting removes the index and its data completely.

beginner

Which HTTP method and endpoint is used to delete an index named my-index?

Use the DELETE method on the endpoint /my-index to delete the index.

beginner

How do you close an index named my-index using Elasticsearch API?

Send a POST request to /my-index/_close to close the index.

intermediate

Why might you want to close an index instead of deleting it?

Closing an index saves system resources by freeing memory and file handles but keeps data intact for later reopening without reindexing.

What happens when you delete an Elasticsearch index?

A The index is archived for later use.

B The index is temporarily hidden but data remains.

C The index is backed up automatically.

D The index and all its data are permanently removed.

Deleting an index removes it and all its data permanently from Elasticsearch.

Which HTTP method is used to close an index?

A DELETE

B GET

C POST

D PUT

Closing an index requires a POST request to the /_close endpoint.

What is the endpoint to delete an index named logs?

A /logs

B /logs/_delete

C /logs/_close

D /logs/_remove

To delete an index, send a DELETE request to the index name endpoint, e.g., /logs.

What is a benefit of closing an index instead of deleting it?

A It keeps data but frees system resources.

B It frees up disk space.

C It automatically reindexes data.

D It makes the index read-only.

Closing an index frees memory and file handles but keeps data intact for reopening.

After closing an index, how can you make it available again?

A Delete and recreate it.

B Send a POST request to <code>/_open</code> endpoint.

C Send a GET request to the index.

D Restart Elasticsearch.

You reopen a closed index by sending a POST request to /{index}/_open.

Explain the difference between deleting and closing an Elasticsearch index and when you might use each.

Think about data permanence and resource management.

Describe the API calls needed to delete and close an index named 'my-index' in Elasticsearch.

Focus on HTTP methods and endpoints.

Practice

1. What happens when you delete an index in Elasticsearch?

easy

A. The index is temporarily hidden but data remains.

B. The index and all its data are permanently removed.

C. The index is locked for editing but still searchable.

D. The index is backed up automatically before removal.

Solution

1. Step 1: Understand the delete operation

   Deleting an index removes it completely from Elasticsearch, including all stored data.

2. Step 2: Compare with closing an index

   Closing an index only frees resources but keeps data safe, unlike deleting.

3. Final Answer:

   The index and all its data are permanently removed. -> Option B

4. Quick Check:

   Delete = permanent removal [OK]

Hint: Delete means gone forever, close means temporary [OK]

Common Mistakes:

• Confusing delete with close operation
• Thinking data is saved after delete
• Assuming delete backs up data automatically

2. Which is the correct syntax to close an index named my_index in Elasticsearch?

easy

A. DELETE /my_index/_close

B. PUT /my_index/_close

C. POST /my_index/_close

D. GET /my_index/_close

Solution

1. Step 1: Identify the HTTP method for closing

   Closing an index uses the POST method with the _close endpoint.

2. Step 2: Verify the endpoint and method

   POST /my_index/_close is the correct syntax to close the index named my_index.

3. Final Answer:

   POST /my_index/_close -> Option C

4. Quick Check:

   Close uses POST with _close [OK]

Hint: Close uses POST method with _close endpoint [OK]

Common Mistakes:

• Using DELETE instead of POST
• Using GET or PUT for closing
• Missing the _close suffix in URL

3. What will be the result of this sequence of commands?

DELETE /test_index
POST /test_index/_close
GET /test_index/_settings

medium

A. Index deleted, error on close, error on get settings

B. Index deleted, close ignored, settings returned

C. Index closed successfully, settings returned

D. Error on DELETE, index remains open, settings returned

Solution

1. Step 1: Analyze DELETE command

   The DELETE command removes test_index permanently.

2. Step 2: Analyze POST close command after deletion

   Since the index is deleted, trying to close it causes an error because it no longer exists.

3. Step 3: Analyze GET settings command

   Getting settings for a deleted index also results in an error as the index is gone.

4. Final Answer:

   Index deleted, error on close, error on get settings -> Option A

5. Quick Check:

   Delete removes index, later commands fail [OK]

Hint: Delete first means index gone, next commands fail [OK]

Common Mistakes:

• Assuming close works after delete
• Expecting settings for deleted index
• Thinking delete only hides index

4. You tried to close an index with POST /myindex/_close but got a 404 error. What is the most likely cause?

medium

A. The index is already closed.

B. You used the wrong HTTP method; DELETE is required.

C. You need to delete the index before closing it.

D. The index myindex does not exist.

Solution

1. Step 1: Understand error causes for closing

   Closing an index fails if the index does not exist in Elasticsearch.

2. Step 2: Check other options

   A 404 specifically indicates the index does not exist. The index is already closed. (already closed) causes a 400 error. POST is the correct method, not DELETE (B). Deleting before closing is not required (D).

3. Final Answer:

   The index myindex does not exist. -> Option D

4. Quick Check:

   Close error usually means index missing [OK]

Hint: Close errors usually mean index missing [OK]

Common Mistakes:

• Using DELETE instead of POST
• Thinking index must be deleted before closing
• Assuming error means index already closed

5. You want to temporarily free resources by closing an index but keep its data safe. Later, you want to reopen it. Which sequence of commands should you use?

hard

A. POST /myindex/_close then POST /myindex/_open

B. DELETE /myindex then POST /myindex/_open

C. POST /myindex/_open then POST /myindex/_close

D. PUT /myindex/_close then DELETE /myindex

Solution

1. Step 1: Close index to free resources

   Use POST /myindex/_close to close the index without deleting data.

2. Step 2: Reopen index when needed

   Use POST /myindex/_open to reopen the closed index and make it searchable again.

3. Final Answer:

   POST /myindex/_close then POST /myindex/_open -> Option A

4. Quick Check:

   Close then open to save and restore resources [OK]

Hint: Close with POST _close, reopen with POST _open [OK]

Common Mistakes:

• Deleting index instead of closing
• Opening before closing
• Using wrong HTTP methods like PUT or DELETE