How to make all indices Read-only

[chris2016 (Chris Wu)]

Hi,

Does anyone  know how to make all indices read-only? I use ELK 5.1.1 

and do not want to use XPACK. Is the approach below the right way to do?

+++++
PUT your_index/_settings
{
"index": {
"blocks.read_only": true
}
}
+++++

Thanks in advance

Cheers,
Chris

[xavierfacq]

Hi,

I think this is the right way, but this query will only turn "your_index" read_only, not all indices.

Ref: https://www.elastic.co/guide/en/elasticsearch/reference/5.1/index-modules.html#dynamic-index-settings

[chris2016 (Chris Wu)]

Hi,

I just had a try about the index settings: blocks.read_only, but it does not work. 

After I have set it to true by running curl -XPUT, I still can delete index pattern from from "manage" in kibana.
I also tried to set blocks.write and blocks.metadata to true, and they all do not work.

Does anyone have other ideas?

Cheers,
Chris.

[chris2016 (Chris Wu)]

Hi,

I noticed that the index is not physically deleted from elasticsearch (by checking disk) even though the index 

pattern has been removed in Kibana. What I actually want to achieve is that all settings/configurations on
Kibana web interface cannot be modified or removed (at least index pattern cannot be deleted, and possible dashboards, etc).

Probably, is this a Kibana question?

Cheers,
Chris.

[xavierfacq]

Yes you should ask this question in the Kibana forum.