Elasticsearch Closed Indice

[aa18afr]

Hi All,

I would like to know if indice is closed all the data from SOC dashboard gets lost of that day indice. Now, if closed indice needs to be reopened then how it can be done? Please provide support, many thanks.

[weslambert]

You can manually open an index by using the following command:

sudo so-elasticsearch-query $index/_open -XPOST

Keep in mind that Curator will likely close the index again soon after re-opening.

You can stop Curator if you only want to view the data for a short amount of time, or adjust the Curator close setting by following the instructions here:

https://docs.securityonion.net/en/2.3/elasticsearch.html#closing-indices