FORBIDDEN/12/index read-only / allow delete (api)]

I'm currently having the same issue with some ES indices. I'd say it has nothing to do with Logstash.

For me, the issue started occurring after the file system of the server running Elasticsearch had been over its threshold. I tried restarting the cluster (currently a single node), but to no avail.

The only thing that helped was reindexing the data in order not to lose anything, then deleting the existing indices.

I'm still trying to solve the same issue for the .kibana index though.

Any advice as to how to avoid this issue in the future and/or best practises or better ways to solve it would be very much appreciated.

2 Likes