Config: Error 403 Forbidden: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];

Can you share your elasticsearch logs? We're looking for anything related to blocking writes. If there's no red flags there it's possible the index got put into a read only state for some other reason, you can reverse this by

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/.monitoring-*/_settings -d '{"index.blocks.read_only_allow_delete": null}'

https://www.elastic.co/guide/en/elasticsearch/reference/6.x/disk-allocator.html has more info on this reset.

3 Likes