# Logstash: retrying failed action with response code: 403; reason=\> blocked by: FORBIDDEN/5/index read-only (api) **URL:** \ **Category:** Elasticsearch\ **Created:** [March 27, 2020, 12:35pm UTC](https://discuss.elastic.co/t/logstash-retrying-failed-action-with-response-code-403-reason-blocked-by-forbidden-5-index-read-only-api/225405 "2020-03-27T12:35:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![pavank](https://avatars.discourse-cdn.com/v4/letter/p/f0a364/32.png) [@pavank](https://discuss.elastic.co/u/pavank)\ **Post date:** [March 27, 2020, 12:35pm UTC](https://discuss.elastic.co/t/logstash-retrying-failed-action-with-response-code-403-reason-blocked-by-forbidden-5-index-read-only-api/225405/1 "2020-03-27T12:35:19Z")
We have set up our production environment with a 5 ES node cluster (3 hot and 2 warm) with a curator executing cronjob to push older logs into the warm nodes. As per industry regulations, curator password expired and was not reset on time, hence older logs filled up the data storage in the hot nodes. Even after password reset and moving older logs into warm nodes, logstash is unable to push the logs into elasticsearch. Attaching the screenshot of the error at logstash and elasticsearch. Let me know if further details are required? Regards, Pavan ![Logstash log](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d9406200517f8898fa531d255669a0824abf1812.png) ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [March 30, 2020, 2:47pm UTC](https://discuss.elastic.co/t/logstash-retrying-failed-action-with-response-code-403-reason-blocked-by-forbidden-5-index-read-only-api/225405/2 "2020-03-30T14:47:47Z")
Please do not post screenshots. That screenshots is hard to read and does not contain the full exception as it is cut off. Use markdown for proper formatting of snippets here. My suspicion is, that you ran out of diskspace, where elasticsearch sets indices to readonly automatically. See [https://www.elastic.co/guide/en/elasticsearch/reference/7.6/disk-allocator.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/disk-allocator.html) for more info, there is also a mention how to unset this setting (which happens by default on 7.6, but not on some older releases). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 27, 2020, 2:47pm UTC](https://discuss.elastic.co/t/logstash-retrying-failed-action-with-response-code-403-reason-blocked-by-forbidden-5-index-read-only-api/225405/3 "2020-04-27T14:47:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.