[FORBIDDEN/12/index read-only / allow delete (api)];"})

Elastic Stack Elasticsearch
1

Can someone please let me know where I can exactly apply these settings in 6.5, as I'm totally new to ELK :

And are these steps applicable on 6.5 version ?

Thank you

2

This typically indicates that you are running out of disk space and have exceeded the 95% flood stage watermark.

3

Yes Christian, I do know that. But I need to know where is the settings to be done exactly. I don't have any clue.

4

Hello,

You need to increase your disk space to eliminate the issue. No need to change any settings.

Regards

5

You need to either delete data or add capacity. Once you are below the watermark you can follow the instructions available here to unlock the indices.

6

Thanks Christian,

So I just need to add below settings to elaticsearch.yml file and restart service :

PUT your_index_name/_settings
{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}

Are there any specific ways to restart elastic service without crashing it down. Because in past, this had happened. As soon as I have restarted the service of elasticsearch, it crashed. I had to reinstall my system for that date !!!

7

Have you freed up space or added capacity? If not it will just go back to read-only again.

I also believe this is an index setting, so it can not be applied through the elasticsearch.yml file. You need to change it using the API.

8

Yes, space has been freed up. Like can you just guide me to simple link, where it just specifically says which file to edit, what needs to added or removed, etc. For me it is going round and round and confusing.

9

There is no file to edit. You need to use the API (as in your example) to again enable the indices. Am not sure whether or not it allows the use of wildcards when specifying the index name.

10

Sorry, to be a pain. Resolved issue by referring below link :

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.