As the time progresses, the documents residing in the older indices will be even less utilized to the level that they might not even be accessed. These indices would use our CPU, main memory, and other resources as they reside in the disk in their nodes. This situation is not a healthy one, as we are simply giving away our resources for the unused or unaccessed data. Elasticsearch provides us a provision to manage this situation by letting us "close" old indices.

Closing an index means that the index would still remain in the cluster with no resource except the disk space being used. The advantage of closing an index is that it is much easier to reopen it than restoring the index from a backup.

We can close that index using the close API:

POST / logstash-02-06-2015/_close

As mentioned earlier, the specified index will be stored in the disk, but all the read/write operations would be blocked for it.

In case we want to reopen the index, we can do so using the open API:

POST...