# Logstash permission problem **URL:** \ **Category:** Logstash\ **Created:** [December 4, 2017, 4:17pm UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175 "2017-12-04T16:17:45Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 4, 2017, 4:17pm UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/1 "2017-12-04T16:17:45Z")
I am running logstash on windows 2016 vm . I use it from administrator command line. I keep getting this message. It won't let me save my visualization on kibana and keeps me from shutting it down (ctrl+c). This is the message: logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=\>"cluster\_block\_exception", "reason"=\>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)] My elasticsearch is operating using default configuration. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 5, 2017, 7:44am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/2 "2017-12-05T07:44:29Z")
It looks like the index is read-only. ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 5, 2017, 7:47am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/3 "2017-12-05T07:47:06Z")
Thanks for the reply. Why would it be? Is it the default behavior? I have no indices at all if to judge by kibana. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 5, 2017, 8:22am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/4 "2017-12-05T08:22:43Z")
Perhaps the ES logs contain clues? I suggest you ask in the Elasticsearch group. ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 5, 2017, 8:28am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/5 "2017-12-05T08:28:32Z")
Do you have any idea how I could get logstash to stop trying this batch operation? It is blocking creation of further indexes. I've tried restarting the machine but it does not help either. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 5, 2017, 8:33am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/6 "2017-12-05T08:33:53Z")
Do you have security enabled? If so, have you given the Logstash user the required privileges on the index you want to write to? ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 5, 2017, 8:37am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/7 "2017-12-05T08:37:41Z")
Thank you for the reply. I haven't defined anything extra besides the [cluster.name](http://cluster.name) and [node.name](http://node.name). ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 5, 2017, 10:11am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/8 "2017-12-05T10:11:09Z")
How much disk space do you have left on the node? ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 5, 2017, 10:26am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/9 "2017-12-05T10:26:43Z")
If you mean on the hard drive where elasticsearch is install then I have some 4 gb ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 5, 2017, 10:29am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/10 "2017-12-05T10:29:57Z")
That may very well be the problem, assuming that puts you over the watermark at 85-90% full... ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 5, 2017, 10:38am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/11 "2017-12-05T10:38:31Z")
It's closer to 80%. Could it still be the problem? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 5, 2017, 11:06am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/12 "2017-12-05T11:06:44Z")
Is Elasticsearch able to write to the data directory? ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 5, 2017, 11:10am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/13 "2017-12-05T11:10:33Z")
How can I test that? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 5, 2017, 11:11am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/14 "2017-12-05T11:11:33Z")
I haven't used Windows in a very long time, so am probably not the right person to answer that... ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 5, 2017, 11:16am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/15 "2017-12-05T11:16:58Z")
How would you have done that on something you do know? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 5, 2017, 11:18am UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/16 "2017-12-05T11:18:21Z")
On linux I would look at the data directory privileges. ---
**Author:** ![Tal\_Druckmann](https://avatars.discourse-cdn.com/v4/letter/t/b9e5f3/32.png) [@Tal\_Druckmann](https://discuss.elastic.co/u/Tal_Druckmann)\ **Post date:** [December 7, 2017, 5:49pm UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/17 "2017-12-07T17:49:08Z")
I have succeeded creating a custom index. I really suspect this has something to do with logstash ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2018, 5:49pm UTC](https://discuss.elastic.co/t/logstash-permission-problem/110175/18 "2018-01-04T17:49:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.