Index [ilm-history -3-0001] blocked by :[TOO_MANY_REQUESTS/12/disk usage exceeded, index has read-only-allow-delete block]

[mba (Mahesh Adhav)]

index [ilm-history -3-0001] blocked by :[TOO_MANY_REQUESTS/12/disk usage exceeded, index has read-only-allow-delete block]

[Christian_Dahlqvist]

If you want someone to help please put some more effort into creating the thread and provide information about you setup, which version of Elasticsearch you are using and how you arrived at this error.

[mba (Mahesh Adhav)]

sure. I m using elasticsearch 7.10.2 version. My setup is like- Filebeat is reading logs from 100 MS and sending to elasticserach via logstash.

so in filebeat----
paths:
- /var/log/*.log

logstash.conf ---

input {
...
}

filter {
...
}

output {
...
}

ELasticsearch.yml ---- just added port number (using default configurations).
http.port: 9200

[dadoonet (David Pilato)]

A guess is that you're running out of disk space?

[mba (Mahesh Adhav)]

Yes. I tried to increase space by following command -

PUT _cluster/settings
{
"transient": {
"cluster.routing.allocation.disk.watermark.low": "100gb",
"cluster.routing.allocation.disk.watermark.high": "50gb",
"cluster.routing.allocation.disk.watermark.flood_stage": "10gb",
"cluster.info.update.interval": "1m"
}
}
Still Elasticsearch throwing same error message.

after that I checked elaticsearch disk space by -

GET _cat/allocation

but It is showing disk space = 7.9 GB and available space=2.2 GB.

Any reason ???

[dadoonet (David Pilato)]

You need to change read-only-allow-delete block.

PUT ilm-history -3-0001/_settings
{
    "index.blocks.read_only_allow_delete": null
}