FORBIDDEN/12/index read-only / allow delete (api)]

Elastic Stack Elasticsearch
1

I am running logstash on windows 2016 vm . I use it from administrator command line. I keep getting this message. It won't let me save my visualization on kibana and keeps me from shutting it down (ctrl+c).

This is the message:
logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]

My elasticsearch is operating using default configuration. I asked on logstash forum but they recommended I ask here. I am completely lost. I've tried restarting all the services, and even the computer. Each time I run logstash it throws me this error

7 Likes
2

I'm currently having the same issue with some ES indices. I'd say it has nothing to do with Logstash.

For me, the issue started occurring after the file system of the server running Elasticsearch had been over its threshold. I tried restarting the cluster (currently a single node), but to no avail.

The only thing that helped was reindexing the data in order not to lose anything, then deleting the existing indices.

I'm still trying to solve the same issue for the .kibana index though.

Any advice as to how to avoid this issue in the future and/or best practises or better ways to solve it would be very much appreciated.

2 Likes
3

Same issue here. gone crazy trying to solve.

Edit: i think my problem is low storage. just check your storage first. when it's low, kibana auto changes its config to read-only mode. to deal with it, go to your dev tools console and
run below command:

PUT .kibana/_settings
{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}

56 Likes
4

I tried doing that with powershell WebRequest but it still gives me this error. I mean this very same command yields the error 'FORBIDDEN/12/index-read-only'

5

try these, maybe these solve your issue.

  PUT _settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }

    PUT your_index_name/_settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }
91 Likes
6

This did the trick. Thank you very much!

3 Likes
7

great then!

5 Likes
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

9

For anyone visiting this topic, please see Why am I seeing a "FORBIDDEN/12/index read-only / allow delete" response against my index?.