Elasticsearch index.blocks.read : true doesn't work with index pattern

Elastic Stack Elasticsearch
1

Hi all,

I want to block read on some indices, using index.blocks.read : true, but it doesn't work if you try to read the indices with index pattern like index_name_*. It will return error

GET filebeat*/_search
{
"error": {
"root_cause": [
{
"type": "cluster_block_exception",
"reason": "blocked by: [FORBIDDEN/7/index read (api)];"
}
],
"type": "cluster_block_exception",
"reason": "blocked by: [FORBIDDEN/7/index read (api)];"
},
"status": 403
}

Another solution I tried is to close the index, but it will mess up my snapshot schedule.

Any suggestions ?

2

It's possible your nodes are running out of disk space, so I would check that and look at Error: disk usage exceeded flood-stage watermark, index has read-only-allow-delete block | Elasticsearch Guide [8.4] | Elastic

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.