Index read-only after upgrading to 7.0

Elastic Stack Elasticsearch
1

Hi!
Saw that ELK 7.0 was available and upgraded my lab. After that I got these errors from logstash:

Apr 11 13:01:38 linuxmgmt.j.local logstash[29896]: [2019-04-11T13:01:38,243][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

I've tried to run PUT /_all/_settings {"index.blocks.read_only_allow_delete": null} and then it works for a minute or two. Then it's back to the original issue.

I've seen other articles where the person was running out of disk but in this case I've got disk space available.

Anyone else seen this issue?

Kind regards,
Patrik

2

This block is applied when running out of disk space indeed, and that's the only circumstances under which it is automatically applied.

There will be messages in the server log giving details of how Elasticsearch arrived at this decision. Look for messages from a logger called DiskThresholdMonitor.

1 Like
3

Thanks David. I deleted a few days of data and everything started to work again.

Kind regards,
Patrik

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.