# Logstash stops processing after forbidden index write

**URL:** <https://discuss.elastic.co/t/logstash-stops-processing-after-forbidden-index-write/217639>\
**Category:** Logstash\
**Created:** [February 3, 2020, 2:53pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-after-forbidden-index-write/217639 "2020-02-03T14:53:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hlamsc](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hlamsc](https://discuss.elastic.co/u/hlamsc)\
**Post date:** [February 3, 2020, 2:53pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-after-forbidden-index-write/217639/1 "2020-02-03T14:53:54Z")

</div>

Hello,

our logstash stops processing all logs after a few FORBIDDEN/8/index write errors. I guess those are documents that have an old timestamp and the index for that timerange is already frozen.  
I believe we had a similar error a few month back and the only way we found out which index / time was meant was by snooping and find the packets related to those error messages. We then set the index from ready\_only to write again and restarted logstash and everything was fine.

Neither in logstash nor elasticsearch are entries that indicate which index is causing this.  
Is there an easier / more comfortable way to find out which index is the root cause for this?

Thanks and best regards!

---

<div class="post-metadata">

**Author:** ![hlamsc](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hlamsc](https://discuss.elastic.co/u/hlamsc)\
**Post date:** [February 5, 2020, 1:18pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-after-forbidden-index-write/217639/2 "2020-02-05T13:18:07Z")

</div>

While it would have been useful for analysis, we are now moving forward and add config so that we use the system time for index creation not the value from @timestamp.

> ruby {  
> code =\> 'event.set("[@metadata][now]", Time.now.strftime("%Y.%m.%d"))'  
> }

and

> ```
> index => "logstash-%{[@metadata][tmplevel]}-%{[@metadata][now]}"
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 1:18pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-after-forbidden-index-write/217639/3 "2020-03-04T13:18:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.