# Logstash trying to write to read-only index endlessly

**URL:** https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356
**Category:** Logstash
**Created:** [January 6, 2021, 3:05pm UTC](https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356 "2021-01-06T15:05:07Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 6, 2021, 3:33pm UTC](https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356/2 "2021-01-06T15:33:08Z")

</div>

There is no such config, logstash will keep on trying to write when it gets an 403 error.

On this old post there is a suggestion to use a ruby filter in the pipeline to drop some events if they are older than some specified time.

> [@Make Logstash drop documents on 403](https://discuss.elastic.co/t/make-logstash-drop-documents-on-403/149977):
>
> Greetings Recently I started using forcemerge on my old indices. However, I found out that occasionally, Logstash writes into the older indices, increasing the segment count, so the curator has to merge them again on the next day. To prevent this, I now switch older indices to read-only just before merging. However, now when I look at the Logstash logs, there is a lot of entries like [2018-09-26T11:59:47,219][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 40…

---

_[View the full topic](https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356)._