does the kibana system user have write permissions on the .kibana index (or whatever the index name was configured to be)? Does that only happen for visualizations or also for dashboards and saved searches?
First, here's the entire stack trace from when I'm trying to save a visualization
Error: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];
at http://localhost:5601/twj/bundles/kibana.bundle.js?v=8467:57750:19
at processQueue (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:47107:37)
at http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:47151:27
at Scope.$digest (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:48289:15)
at Scope.$apply (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:48587:24)
at done (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:42608:47)
at completeRequest (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:42834:7)
at XMLHttpRequest.requestLoaded (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:42762:9)
I'm using Windows 10 Home.
does the kibana system user have write permissions on the .kibana index (or whatever the index name was configured to be)
I'm the admin of the system where Kibana is installed. The index name is logstash-0. I don't know where the index is stored on Windows.
Does that only happen for visualizations or also for dashboards and saved searches?
This is what I get from trying to save a dashboard.
Error: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];
at http://localhost:5601/twj/bundles/kibana.bundle.js?v=8467:57750:19
at processQueue (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:47107:37)
at http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:47151:27
at Scope.$digest (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:48289:15)
at Scope.$apply (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:48587:24)
at done (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:42608:47)
at completeRequest (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:42834:7)
at XMLHttpRequest.requestLoaded (http://localhost:5601/twj/bundles/commons.bundle.js?v=8467:42762:9)
Not sure how to save a search, since I don't have anything to search for (also first time user, so I might not know how).
If the read-only status is set repeatedly as you indicated before, my best guess is that Elasticsearch does not deem it safe to leave the indices in writable state. There are several conditions that can cause this, e.g. low free disk space. Could you please check the Elasticsearch log for any indication of why it set the indices to read-only?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.