# Yet another "FORBIDDEN/12/index read-only" message
**URL:** https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772
**Category:** Elasticsearch
**Created:** [January 16, 2018, 6:22pm UTC](https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772 "2018-01-16T18:22:44Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@dorj1234](https://discuss.elastic.co/u/dorj1234)
#### Post date: [January 16, 2018, 6:22pm UTC](https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772/1 "2018-01-16T18:22:45Z")
Yet another message of this type. I read past similar messages but none really help me.
This alert pops up in Kibana when I try to create any new index.
The hard drive has enough space, this is not the reason.
My thought was that this is a filesystem permission but if it is, I can't find where.
`Config: Error 403 Forbidden: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];`
Any advice appreciated.
Best,
JD
---
### Author:  [@ywelsch](https://discuss.elastic.co/u/ywelsch)
#### Post date: [January 19, 2018, 10:00am UTC](https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772/2 "2018-01-19T10:00:54Z")
Can you have a look at the Elasticsearch cluster logs and check if there are any warnings there? In particular, can you grep for "flood stage disk watermark"?
---
### Author:  [@dorj1234](https://discuss.elastic.co/u/dorj1234)
#### Post date: [January 19, 2018, 5:14pm UTC](https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772/3 "2018-01-19T17:14:24Z")
Hello, thank you for the reply. After reading previous posts the first thing I did was check disk usage and I was far from 50% on all the mount points.
Also - I could not continue this way and reverted the ELK VM to a previous snapshot, then re-upgraded.
It would be great to know what causes this for other people though, but it is not disk space.
---
### Author:  [@s1monw](https://discuss.elastic.co/u/s1monw)
#### Post date: [January 22, 2018, 8:51am UTC](https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772/4 "2018-01-22T08:51:03Z")
the question is what were disks at the point when elasticsearch decided to put this block in. It's the only reason this could happen as far as I know.
---
### Author:  [@dorj1234](https://discuss.elastic.co/u/dorj1234)
#### Post date: [January 23, 2018, 7:13pm UTC](https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772/5 "2018-01-23T19:13:54Z")
This is a test machine, nothing happens on it aside from my logstash code. It is at all times around 50% disk-space, no spikes or changes, and no one else touches the VM, the error was repeatable.
If disk space is the only reason for this error, then I would suggest this could be a bug. If someone in Elastic is interested (for troubleshooting reasons) I can go back to the "broken" Logstash, which I keep as a VM snapshot
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 20, 2018, 7:14pm UTC](https://discuss.elastic.co/t/yet-another-forbidden-12-index-read-only-message/115772/6 "2018-02-20T19:14:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.