I'm having problem accessing a sketch...

[kiddinn]

How this looks like:

• You've got a sketch with some timelines in it.
• You delete one or more of the timelines (but not all)
• Attempting to access the sketch now in the UI produces a white screen, with no data... the logs in the backend indicate something on the lines of

elasticsearch.exceptions.RequestError: RequestError (400, 'index_closed_exception', 'closed')

There was a bug in the code around the time version 20210224 was released that has since been fixed. This should therefore not happen again, but if you had installed that version and come across this issue the solution is to look into the API client and run the following commands:

from timesketch_api_client import config

ts_client = config.get_client()
sketch = ts_client.get_sketch(123)

sketch.archive()
sketch.unarchive()

This will close all open indices and then re-open them, making the indices available again.

[kiddinn]

this got fixed in #1664