Locked/read only indices

Elastic Stack Elasticsearch
1

When I try to change my visualizations in Kibana I get the following message:
Visualization Editor: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];

So somehow my indices got locked.
I allready tried out the proposed solution in the following post, which unfortunately doesn't work for me:

Do you have another idea what I could try to unlock the indexes again?

2

This often means that you are running out of disk space and have passed one of the high watermark thresholds. Unless you correct this indices will go back into read-only state.

3

Thanks for the quick response. On the partition I am storing my indexes there is still over 200GB of disk space left.

4

How big is the partition? The threshold is by default specified as a percentage.

5

The partition is 5 Terrabyte in size.
Is there away to change the threshold or even deactivate it?

6

Yes, you can change it. Be sure it does not make you run out of disk space though as that can cause corruption. Look for watermark in the docs.

7

Thank you so much for your help. I ran the following command to disable the threshold:

PUT /_cluster/settings
{
"persistent" : {
"cluster.routing.allocation.disk.threshold_enabled" : false
}
}

After that I restarted the elasticsearch and Kibana services, ran the following command:

PUT .kibana/_settings
{
"index": {
"blocks": {
"read_only_allow_delete": false
}
}
}

Now it works again.

4 Likes
8

Be careful with that though as you could run into serious problems now that you have disabled this safety check. There is a good reason it is there by default...

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.