Know if one or more indexes are marked as read only

Elastic Stack Elasticsearch
1

When an elastic index moves into a read only state, it can prevent additional data being written to the cluster. Typically a read only state occurs when an index in on a node that reaches 85% disk space used.

The cluster does have an API to get details for each index, so it may be possible to scan each index and check if it's in read only state.

  • how to know if one or more indexes are marked as read only, would you please let me know?
  • how can we generate an alert somewhere - likely grafana - when this happens
    Note: we use cerebro ES admin tool as well
2

You can retrieve the settings of all indices, and check for the index blocks settings, and probably especially for the one that only allows deletes. See https://www.elastic.co/guide/en/elasticsearch/reference/7.6/disk-allocator.html

Just a side note, newer Elasticsearch releases will automatically change the index to be writeable again, since version 7.4.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.