Kibana filter autocomplete fail due to closed indexes (suggestions api)

Hello, running on:

RoR 1.25.0
Kibana 6.8.11

I have found that autocomplete in kibana when using a “keyword” field only works on index patterns that do not match any closed indexes. For any index patterns that resolve to open and closed indexes a code 400 Bad request is sent back from kibana.

Digging into this further it seems in 6.0 Breaking changes it is mentioned:

IndexClosedException to return 400 status code

An IndexClosedException is returned whenever an api that doesn’t support closed indices (e.g. search) is called passing closed indices as parameters and ignore_unavailable is set to false. The response status code returned in such case changed from 403 to 400

To debug this I performed a packet capture of the traffic being sent from kibana into the ES search co-ordinator Below is an excerpt from an affected request:

POST /techno*/_search
<Headers ....>
content-type: application/json
Content-Length: 203
Connection: keep-alive

The response comes back as:

HTTP/1.1 400 Bad Request
content-type: application/json; charset=UTF-8
content-length: 291

For this to work the request needs to be sent with “?ignore_unavailable=true” option in the URL or the relevant option set in the request body.

POST /techno*/_search?ignore_unavailable=true



Again this works fine if your using an index pattern that does not involve any closed indexes. Worth noting is that previously we were using ES:6.5.4 and and this was not an issue.

Thanks in advance for what I presume is an easy fix…