Logstash permission problem

Elastic Stack Logstash
1

I am running logstash on windows 2016 vm . I use it from administrator command line. I keep getting this message. It won't let me save my visualization on kibana and keeps me from shutting it down (ctrl+c).

This is the message:
logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]

My elasticsearch is operating using default configuration.

2

It looks like the index is read-only.

3

Thanks for the reply. Why would it be? Is it the default behavior? I have no indices at all if to judge by kibana.

4

Perhaps the ES logs contain clues? I suggest you ask in the Elasticsearch group.

5

Do you have any idea how I could get logstash to stop trying this batch operation? It is blocking creation of further indexes. I've tried restarting the machine but it does not help either.

6

Do you have security enabled? If so, have you given the Logstash user the required privileges on the index you want to write to?

7

Thank you for the reply. I haven't defined anything extra besides the cluster.name and node.name.

8

How much disk space do you have left on the node?

9

If you mean on the hard drive where elasticsearch is install then I have some 4 gb

10

That may very well be the problem, assuming that puts you over the watermark at 85-90% full...

11

It's closer to 80%. Could it still be the problem?

12

Is Elasticsearch able to write to the data directory?

13

How can I test that?

14

I haven't used Windows in a very long time, so am probably not the right person to answer that...

15

How would you have done that on something you do know?

16

On linux I would look at the data directory privileges.

17

I have succeeded creating a custom index. I really suspect this has something to do with logstash

18

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.