FORBIDDEN/8/index write (api) - During date change on indexes

[dakrone (Lee Hinman)]

@KevSex

So I take it, a force merge doesn't have a prerequisite to set the index to read-only?

Nope, no prerequisite for that.

@KevSex

1. Updated elasticsearch outputs to include manage_template => false
2. Update Index Lifecycle Management warm phase min_age value to 25h

This has stopped the issue from occurring but looking to confirm which of the above affected this. I'd like to say the ILM change as the elasticsearch output had been working fine without the manage_template parameter and it was ILM that was recently updated.

Can anyone confirm?

I don't think either of those would cause anything related to the index being read-only. Is it possible that your node filled up with disk space and the index was marked read only because of that?