Re-Allow Write After Index Shrink

Hello all!

Currently on Elasticsearch 7.17. I have a data stream with an ILM policy that rolls data over from Hot to Warm after a period of time. Once an index rolls over to the Warm phase it is shrunk, which I understand sets the index to read-only. It's not terribly common, but it's also not terribly uncommon for us to find ourselves needing to update documents in those shrunken indices sometimes. This requires us to go and figure out which shrunken indices are blocking writes and set "index.blocks.write": "false" before we can perform any updates.

My question is: is there some way I can set the resulting target index of the Shrink operation to "index.blocks.write": "false" automatically after the Shrink operation is completed? I was looking at the [Shrink | Elasticsearch Guide [7.17] | Elastic](https://Shrink Operation docs) but I don't see anything mentioned there. Is this maybe possible in some kind of "post-rollover script"?

Thanks in advance for any help you can provide!

We were discussing this internally a few days ago in fact. There's no option to do this in the ILM shrink action today unfortunately although the shrink API itself does have a way to specify that the shrunken index should be writeable. For now I think you could reasonably just set index.blocks.write: false on every (shrunken) index at once, since the index settings API supports wildcards in the <target> parameter.

Thank you for the quick response! I'll look at approaching this in a different fashion with the Shrink API. I appreciate the help!

I would expect it to be easier to just remove all blocks as and when you need to do a write - you'll lose many of the benefits of ILM if you do the shrink manually. But fwiw here's how you do it with the shrink API:

POST /original-index/_shrink/shrunken-index
  "settings": {
    "blocks.write": false, <-- this is what tells Elasticsearch to unblock the shrunken index
    "number_of_shards": 1
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.