Rule execution failure: Rule registry writing is disabled

Elastic Stack Kibana
2

Hi @alytkowski,

RuleDataClient initialization can fail for a few different reasons. In order to determine what's going wrong here, some additional information would be helpful.

  1. Have any changes been made to the ILM policy ".alerts-ilm-policy"? The rule data client initialization can fail if the ILM policy has been edited to roll alerts indices over to cold or snapshot tiers. ([Response Ops] RuleDataClient initialization fails if any alerts indices are snapshots · Issue #139969 · elastic/kibana · GitHub)
  2. We've also seen RuleDataClient initialization fail if Elasticsearch is overloaded when the RuleDataClient attempts to initialize.

In either case, the Kibana logs that show the initialization failure would be helpful to identify the cause. You can filter for the logs for plugins.ruleRegistry to narrow them down when searching for the initialization failure. Also, for security rules, the RuleDataClient will attempt to initialize the first time a rule tries to write an alert after Kibana starts up.