Kibana does not show data from frozen indexes in search/Discover of ElasticSearch

Question

When I search a time-period last august where I only have frozen index-data, kibana finds no matches. When I unfreeze one of the-augest-indexes Kibana Discover finds the data. If I freeze it again, no data again. I'm using ELKStack 7.5.2.

What gives?

According to docs they should be searchable. I'm pretty sure no other queries are running, so it cannot be the frozen-search limit by search_throttled (well unless its zero or some weird thing).

Answer 1

You are looking for

search:includeFrozen

Includes frozen indices in results. Searching through frozen indices might increase the search time. This setting is off by default. Users must opt-in to include frozen indices.

This needs to be set under advanced settings in Kibana.

Official link: https://www.elastic.co/guide/en/kibana/current/advanced-options.html