# Index setting read\_only\_allow\_delete does not allow \_delete\_by\_query

**URL:** <https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719>\
**Category:** Elasticsearch\
**Created:** [February 24, 2019, 12:14pm UTC](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719 "2019-02-24T12:14:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamredlus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iamredlus/32/15504_2.png) [@iamredlus](https://discuss.elastic.co/u/iamredlus)\
**Post date:** [February 24, 2019, 12:14pm UTC](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719/1 "2019-02-24T12:14:58Z")

</div>

Hi

After applying read\_only\_allow\_delete to an index -  
PUT /index\_name/\_settings

```
{
    "index": {
        "blocks": {
            "read_only_allow_delete": true
        }
    }
}

```

Issuing a \_delete\_by\_query produces the following failures:

```
{
    "took": 789,
    "timed_out": false,
    "total": 18951,
    "deleted": 0,
    "batches": 1,
    "version_conflicts": 0,
    "noops": 0,
    "retries": {
        "bulk": 0,
        "search": 0
    },
    "throttled_millis": 0,
    "requests_per_second": -1,
    "throttled_until_millis": 0,
    "failures": [
        {
            "index": "index_name",
            "type": "logs",
            "id": "mPs8vWgBqIRu5N0y1gmI",
            "cause": {
                "type": "cluster_block_exception",
                "reason": "blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"
            },
            "status": 403
        }
        .
        .
        .
        (many more errors like this one)
    ]
}

```

Only by removing read\_only\_allow\_delete I've been able to successfully run the delete query.

Why is this happening?  
Shouldn't this setting allow deletion?  
If not, I'd specifically note this in the documentation. Also, it would be nice to have such a setting where new deleting and indexing a new document would not be considered the same action.

Thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 24, 2019, 12:23pm UTC](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719/2 "2019-02-24T12:23:41Z")

</div>

That privilege allows you to delete the full index, not individual documents from it, which is what delete by query does.

---

<div class="post-metadata">

**Author:** ![iamredlus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iamredlus/32/15504_2.png) [@iamredlus](https://discuss.elastic.co/u/iamredlus)\
**Post date:** [February 24, 2019, 8:48pm UTC](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719/3 "2019-02-24T20:48:46Z")

</div>

Is there any setting which allows the deletion of documents, but not indexing?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 24, 2019, 8:55pm UTC](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719/4 "2019-02-24T20:55:01Z")

</div>

No, I do not believe there is.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2019, 8:55pm UTC](https://discuss.elastic.co/t/index-setting-read-only-allow-delete-does-not-allow-delete-by-query/169719/5 "2019-03-24T20:55:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.