Grok filter not extracting fields

For some reason the index has been set to read only. Check your ES logs and see if FORBIDDEN/12/index read-only / allow delete (api)] is helpful.