# Elasticsearch index stopped

**URL:** <https://discuss.elastic.co/t/elasticsearch-index-stopped/290021>\
**Category:** Elasticsearch\
**Created:** [November 24, 2021, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-index-stopped/290021 "2021-11-24T07:48:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bahman\_shahrzad\_asr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bahman_shahrzad_asr/32/97483_2.png) [@bahman\_shahrzad\_asr](https://discuss.elastic.co/u/bahman_shahrzad_asr)\
**Post date:** [November 24, 2021, 7:48am UTC](https://discuss.elastic.co/t/elasticsearch-index-stopped/290021/1 "2021-11-24T07:48:44Z")

</div>

have graylog 4.x on ubuntu 20.04. standard installation.  
I can log in to my gralog but all data is one week old.  
services says running but : graylog-server.service: Failed with result ‘timeout’.  
in graylog log i have warning  
\<  
WARN [MessagesAdapterES6] Failed to index message: index=\<graylog\_0\> id= error=\<{“type”:“cluster\_block\_exception”,“reason”:“blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];”}\>

in syslog i have error :  
2021-11-18T23:25:02.093084+00:00 rsyslog systemd[1]: motd-news.service: Failed with result ‘exit-code’.  
2021-11-18T23:25:02.094389+00:00 rsyslog systemd[1]: Failed to start Message of the Day.

my Elasticsearch is :  
~# curl localhost:9200  
{  
“name” : “peoR6Gc”,  
“cluster\_name” : “graylog”,  
“cluster\_uuid” : “o-clJDFLSz2BcV-fK5ld\_Q”,  
“version” : {  
_ **"number" : "6.8.20"** _ ,  
“build\_flavor” : “oss”,  
“build\_type” : “deb”,  
“build\_hash” : “c859302”,  
“build\_date” : “2021-10-07T22:00:24.085009Z”,  
“build\_snapshot” : false,  
“lucene\_version” : “7.7.3”,  
“minimum\_wire\_compatibility\_version” : “5.6.0”,  
“minimum\_index\_compatibility\_version” : “5.0.0”  
},  
“tagline” : “You Know, for Search”

and graylog version 4.2

logfile /var/log/elas…/graylog say  
[2021-11-19T22:23:35,163][WARN][o.e.c.r.a.DiskThresholdMonitor] [peoR6Gc] high disk watermark [90%] exceeded on [peoR6GcRQpqhJZlebPSo5g][peoR6Gc][/var/lib/Elasticsearch/nodes/0] free: 1.4gb[9.3%], shards will be relocated away from this node  
..  
...  
…  
[2021-11-20T03:45:38,447][INFO][o.e.c.r.a.DiskThresholdMonitor] [peoR6Gc] low disk watermark [85%] exceeded on [peoR6GcRQpqhJZlebPSo5g][peoR6Gc][/var/lib/Elasticsearch/nodes/0] free: 2.3gb[14.8%], replicas will not be assigned to this node

/\>

---

<div class="post-metadata">

**Author:** ![DineshNaik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dineshnaik/32/89308_2.png) [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)\
**Post date:** [November 24, 2021, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-index-stopped/290021/2 "2021-11-24T08:16:38Z")

</div>

An index goes into read-only mode when the flood stage is hit for a node.

As you can see :

> [@bahman\_shahrzad\_asr](#):
>
> high disk watermark [90%] exceeded on [peoR6GcRQpqhJZlebPSo5g][peoR6Gc][/var/lib/Elasticsearch/nodes/0]

The index block is automatically released when the disk utilization falls below the high watermark post ES version 7.4

but as your ES version is lower than 7 , you will need to clear the usage first so that it goes below 90% then change the index setting manually for your ES version to fix the issue.

```auto
PUT your_index_name/_settings
{
 "index": {
   "blocks": {
     "read_only_allow_delete": "false"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 22, 2021, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-index-stopped/290021/3 "2021-12-22T08:16:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.