Https://discuss.elastic.co/t/config-error-403-forbidden-blocked-by-forbidden-12-index-read-only-allow-delete-api-cluster-block-exception-blocked-by-forbidden-12-index-read-only-allow-delete-api/113361

[rouchad_rouchad]

hello everybody ! please i need your help !!
the index got put into a read only state for some other reason, i reverse this by :

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/.monitoring-*/_settings -d '{"index.blocks.read_only_allow_delete": null}'

but when i do it i got this error :

C:\Users\goldenBoy>curl -XPUT -H "Content-Type: application/json" http://localhost:9200/.monitoring-*/_settings -d '{"index.blocks.read_only_allow_delete": null}'
{"error":{"root_cause":[{"type":"json_parse_exception","reason":"Unexpected character (''' (code 39)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@197352e7; line: 1, column: 2]"}],"type":"json_parse_exception","reason":"Unexpected character (''' (code 39)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@197352e7; line: 1, column: 2]"},"status":500}curl: (3) [globbing] unmatched close brace/bracket in column 5

[Brandon_Kobel]

Hey @rouchad_rouchad, that curl command works for me, which version of Elasticsearch are you running, and do you have a reverse proxy in front of Elasticsearch?

[Brandon_Kobel]

I just noticed that you were on Windows, try using this instead:

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/.monitoring-*/_settings -d "{\"index.blocks.read_only_allow_delete\": null}"

[rouchad_rouchad]

thank you Mr Brandon... i use elasticsearch 6.2.3
i try ths solutiob but i get this error :
{"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":".monitoring-","index_uuid":"na","index":".monitoring-"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":".monitoring-","index_uuid":"na","index":".monitoring-"},"status":404}

what i need to do ?
! thank u very much

[Brandon_Kobel]

Which index are you trying to turn-off read only mode on? That command that you're executing will update that setting in index patterns that match monitoring-* and the error message is alluding to those indices not existing.

[rouchad_rouchad]

hi Brandon ;
I want to enter a new index "emails" but I can not see it on kibana , i don't know why ... when i execute Logstash i got the index name in kibana but when i want to see the result there is nothing
just the name of the index emails

[Brandon_Kobel]

Hey @rouchad_rouchad, Kibana introduces the concept of an "Index Pattern" in addition to the indices that are already created in Elasticsearch. To begin to use Kibana with the new "emails" index, you'll want to create a new Index Pattern in Kibana per: https://www.elastic.co/guide/en/kibana/current/index-patterns.html

[Christian_Dahlqvist]

The error you listed may mean you are running out of available disk space and have exceeded the 95% flood watermark. Can you check whether this is the case?