# Log stash error

**URL:** <https://discuss.elastic.co/t/log-stash-error/206141>\
**Category:** Logstash\
**Created:** [November 1, 2019, 10:09am UTC](https://discuss.elastic.co/t/log-stash-error/206141 "2019-11-01T10:09:51Z")\
**Posts on this page:** 1\
**Showing post:** 17

<div class="post-metadata">

**Author:** ![Seetharaman\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seetharaman_k/32/52542_2.png) [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\
**Post date:** [November 5, 2019, 5:43pm UTC](https://discuss.elastic.co/t/log-stash-error/206141/17 "2019-11-05T17:43:45Z")

</div>

seems i have corrected the configuration as you suggested . why i am sure , because got the below screen after i tested the config

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a4c0ee092595efdc5b7dcf70f99e9afeb4944e55.png) , but when logstash service runs i again got following error

> [2019-11-05T17:57:17,176][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index [totalexecution-2019] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
> [2019-11-05T17:57:17,176][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=\>1}  
> [2019-11-05T17:57:17,176][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index [totalexecution-2019] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
> [2019-11-05T17:57:17,176][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=\>1}  
> [2019-11-05T17:57:17,184][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index [totalexecution-2019] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
> [2019-11-05T17:57:17,188][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=\>1}  
> [2019-11-05T17:57:17,188][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index [totalexecution-2019] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
> [2019-11-05T17:57:17,188][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index [totalexecution-2019] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
> [2019-11-05T17:57:17,188][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"index [totalexecution-2019] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})  
> [2019-11-05T17:57:17,188][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=\>3}

two kind of post discuss about this.  
1.disk space issue (which is not in my case )  
2.[this post talks about locked indices](https://discuss.elastic.co/t/logstash-error-retrying-failed-action-with-response-code-403/174864/2)

not sure how to identify the actual problem

---

_[View the full topic](https://discuss.elastic.co/t/log-stash-error/206141)._