Unable to perform insert or delete action in elasticsearch

[swati_dupare]

Hi,

I am getting below error when I am trying to insert or delete data from elasticsearch :
index [index_name] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)

Thanks

[HenningAndersen]

Hi @swati_dupare,

I think this is caused by running out of disk space. For recent Elasticsearch versions (7.4+), the block will be removed automatically when disk space issue has been cleared.

You should still be able to delete indices to free up space (if you have some you do not need). You can also add nodes to increase disk space or increase the size of the underlying volumes.

[swati_dupare]

How can I add nodes to increase disk space or increase the size of the underlying volumes

[HenningAndersen]

Hi @swati_dupare,

this very much depends on how you are running Elasticsearch.

If you are trying this out on ESS, you can use the cloud console to increase instance size.

If you have a single node deployment, there may be multiple steps in adding a node, which also depends on the Elasticsearch version. First of all, you need to ensure the node passes the production bootstrap checks and think about security (since you will likely be opening up the node for external communication).

If you run your own deployment on your own hardware, your host administrators should be able to help expand the volumes (if possible).

Can you add some context to what kind of deployment you have (nodes, size, hosted vs cloud etc.)?

[elasticforme (Sachin)]

just side note:

once you add the space (either on local node or add new node) you must have to do this in order to enable everything back. if it is not fixed automatically as Henning said.

PUT _all/_settings
{
"index.blocks.read_only_allow_delete": null
}

[swati_dupare]

Thanks for reply.

I think because of elasticsearch logs my disk space is full.
Do you have any idea about how to delete logs from elasticsearch periodically or
How can I delete old logs in elasticsearch came from logstash

[HenningAndersen]

Hi @swati_dupare,

when you say elasticsearch logs, do you mean the elasticsearch log file or log data ingested into elasticsearch?

Inside Elasticsearch, going forward, you can use [Index LIfecycle Management] (https://www.elastic.co/guide/en/elasticsearch/reference/7.5/index-lifecycle-management.html) to control the retention of log data.