磁盘空间满导致ELK索引变成只读状态

On By 去哪儿

软件版本：

kibana 6.8.9

Elastic 6.8.9

在 Kibana 中创建索引模式时，一直卡在如下界面导致未创建成功：

查看kibana日志文件一直提示报错，索引变成只读状态

[2023-04-30T14:36:33,593][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2023-04-30T14:36:33,593][INFO ][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>116}

解决方法：

curl -XPUT -H 'Content-Type: application/json' http://172.30.8.96:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'