# Flood-stage watermark?

**URL:** <https://discuss.elastic.co/t/flood-stage-watermark/291217>\
**Category:** Kibana\
**Created:** [December 8, 2021, 12:47pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217 "2021-12-08T12:47:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![maltewhiite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maltewhiite/32/94551_2.png) [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\
**Post date:** [December 8, 2021, 12:47pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217/1 "2021-12-08T12:47:42Z")

</div>

Hello.

English isn't my first language.

How do I troubleshoot this error-message? What does it mean?

What is the solution? We never got this error when we used the old daily indices. Now we get them after transitioning to ILM indices with default settings.

**Index Lifecycle Error:**  
`cluster_block_exception: index [filebeat-7.13.2-000001] blocked by: [TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage watermark, index has read-only-allow-delete block];`

**Stacktrace:**  
[https://pastebin.com/raw/hTZ7pWXK](https://pastebin.com/raw/hTZ7pWXK)

**Images from Kibana:**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6ae8172d6a39b5d23c16f9fe6e927668060bce5.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75b33ecd1b822cbee176b742ac1841313b7a0eb8.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9ba8380223bd52828a800f74ab379f867cad9166.png)

---

<div class="post-metadata">

**Author:** ![maltewhiite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maltewhiite/32/94551_2.png) [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\
**Post date:** [December 9, 2021, 11:25am UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217/2 "2021-12-09T11:25:06Z")

</div>

Is the problem simply that my storage is running full? I tried lowering the ILM time from 30 days to 7 days, and deleting the old indices and retrying lifecycle step. Hopefully that will work. Seems to work so far.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 9, 2021, 1:35pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217/3 "2021-12-09T13:35:24Z")

</div>

> [@maltewhiite](#):
>
> Is the problem simply that my storage is running full?

Probably yes, if your cluster went into flood stage, this mean that 95% of the available space was in use, when this happens elasticsearch force the indices to be read-only. [[documentation](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/modules-cluster.html#disk-based-shard-allocation)]

You may also need to manually reset the read-only in your indices.

```auto
PUT /index-name/_settings
{
  "index.blocks.read_only_allow_delete": null
}

```

---

<div class="post-metadata">

**Author:** ![maltewhiite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maltewhiite/32/94551_2.png) [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\
**Post date:** [December 9, 2021, 1:50pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217/4 "2021-12-09T13:50:19Z")

</div>

Thank you. Yes, the cluster was at exactly 95%.

I will go fire off that command in the Dev Tools.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 6, 2022, 1:50pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217/5 "2022-01-06T13:50:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.