Why Deleting and closing indexes in Elasticsearch? - Purpose & Use Cases

The Big Idea

What if you could instantly hide or remove huge data sets without risking mistakes or downtime?

The Scenario

Imagine you have a huge library of books (data) organized on shelves (indexes). Over time, some shelves become outdated or unused. You try to manually remove or hide these shelves by physically moving books around or covering them with cloth.

The Problem

This manual approach is slow and risky. You might accidentally remove important books or lose track of which shelves are still needed. It's hard to keep the library organized and efficient without a clear system.

The Solution

Deleting and closing indexes in Elasticsearch lets you quickly remove or temporarily disable data collections without losing control. Deleting removes the data permanently, while closing keeps it safe but hidden, freeing resources.

Before vs After

✗ Before

curl -XDELETE 'http://localhost:9200/old_index'
curl -XPOST 'http://localhost:9200/old_index/_close'

✓ After

DELETE /old_index
POST /old_index/_close

What It Enables

This concept enables efficient management of data storage, improving search speed and saving system resources effortlessly.

Real Life Example

A company archives last year's sales data by closing its index to save memory but can reopen it anytime for audits. Old marketing campaigns' data can be deleted permanently to keep the system clean.

Key Takeaways

Manual data cleanup is slow and error-prone.

Deleting and closing indexes provide safe, fast ways to manage data.

They help keep Elasticsearch fast and organized.

Practice

1. What happens when you delete an index in Elasticsearch?

easy

A. The index is temporarily hidden but data remains.

B. The index and all its data are permanently removed.

C. The index is locked for editing but still searchable.

D. The index is backed up automatically before removal.

Solution

1. Step 1: Understand the delete operation

   Deleting an index removes it completely from Elasticsearch, including all stored data.

2. Step 2: Compare with closing an index

   Closing an index only frees resources but keeps data safe, unlike deleting.

3. Final Answer:

   The index and all its data are permanently removed. -> Option B

4. Quick Check:

   Delete = permanent removal [OK]

Hint: Delete means gone forever, close means temporary [OK]

Common Mistakes:

• Confusing delete with close operation
• Thinking data is saved after delete
• Assuming delete backs up data automatically

2. Which is the correct syntax to close an index named my_index in Elasticsearch?

easy

A. DELETE /my_index/_close

B. PUT /my_index/_close

C. POST /my_index/_close

D. GET /my_index/_close

Solution

1. Step 1: Identify the HTTP method for closing

   Closing an index uses the POST method with the _close endpoint.

2. Step 2: Verify the endpoint and method

   POST /my_index/_close is the correct syntax to close the index named my_index.

3. Final Answer:

   POST /my_index/_close -> Option C

4. Quick Check:

   Close uses POST with _close [OK]

Hint: Close uses POST method with _close endpoint [OK]

Common Mistakes:

• Using DELETE instead of POST
• Using GET or PUT for closing
• Missing the _close suffix in URL

3. What will be the result of this sequence of commands?

DELETE /test_index
POST /test_index/_close
GET /test_index/_settings

medium

A. Index deleted, error on close, error on get settings

B. Index deleted, close ignored, settings returned

C. Index closed successfully, settings returned

D. Error on DELETE, index remains open, settings returned

Solution

1. Step 1: Analyze DELETE command

   The DELETE command removes test_index permanently.

2. Step 2: Analyze POST close command after deletion

   Since the index is deleted, trying to close it causes an error because it no longer exists.

3. Step 3: Analyze GET settings command

   Getting settings for a deleted index also results in an error as the index is gone.

4. Final Answer:

   Index deleted, error on close, error on get settings -> Option A

5. Quick Check:

   Delete removes index, later commands fail [OK]

Hint: Delete first means index gone, next commands fail [OK]

Common Mistakes:

• Assuming close works after delete
• Expecting settings for deleted index
• Thinking delete only hides index

4. You tried to close an index with POST /myindex/_close but got a 404 error. What is the most likely cause?

medium

A. The index is already closed.

B. You used the wrong HTTP method; DELETE is required.

C. You need to delete the index before closing it.

D. The index myindex does not exist.

Solution

1. Step 1: Understand error causes for closing

   Closing an index fails if the index does not exist in Elasticsearch.

2. Step 2: Check other options

   A 404 specifically indicates the index does not exist. The index is already closed. (already closed) causes a 400 error. POST is the correct method, not DELETE (B). Deleting before closing is not required (D).

3. Final Answer:

   The index myindex does not exist. -> Option D

4. Quick Check:

   Close error usually means index missing [OK]

Hint: Close errors usually mean index missing [OK]

Common Mistakes:

• Using DELETE instead of POST
• Thinking index must be deleted before closing
• Assuming error means index already closed

5. You want to temporarily free resources by closing an index but keep its data safe. Later, you want to reopen it. Which sequence of commands should you use?

hard

A. POST /myindex/_close then POST /myindex/_open

B. DELETE /myindex then POST /myindex/_open

C. POST /myindex/_open then POST /myindex/_close

D. PUT /myindex/_close then DELETE /myindex

Solution

1. Step 1: Close index to free resources

   Use POST /myindex/_close to close the index without deleting data.

2. Step 2: Reopen index when needed

   Use POST /myindex/_open to reopen the closed index and make it searchable again.

3. Final Answer:

   POST /myindex/_close then POST /myindex/_open -> Option A

4. Quick Check:

   Close then open to save and restore resources [OK]

Hint: Close with POST _close, reopen with POST _open [OK]

Common Mistakes:

• Deleting index instead of closing
• Opening before closing
• Using wrong HTTP methods like PUT or DELETE