# Graylog stopped working Indice blocked

**URL:** <https://community.graylog.org/t/graylog-stopped-working-indice-blocked/30375>\
**Category:** Graylog Central (peer support)\
**Created:** [October 18, 2023, 10:52am UTC](https://community.graylog.org/t/graylog-stopped-working-indice-blocked/30375 "2023-10-18T10:52:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jrecho](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jrecho/32/15139_2.png) [@jrecho](https://community.graylog.org/u/jrecho)\
**Post date:** [October 18, 2023, 10:52am UTC](https://community.graylog.org/t/graylog-stopped-working-indice-blocked/30375/1 "2023-10-18T10:52:06Z")

</div>

Continuing the discussion from [Indices blocked](https://community.graylog.org/t/indices-blocked/26351/3):

> [@Indices blocked](https://community.graylog.org/t/indices-blocked/26351/3):
>
> curl -XPUT -H “Content-Type: application/json” [https://localhost:9200/\_all/\_settings](https://localhost:9200/_all/_settings) -d ‘{“index.blocks.read\_only\_allow\_delete”: null}’

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**

**2. Describe your environment:**

- OS Information: Ubuntu server 22.05:

- Package _5.1.6_

- Service logs, configurations, and environment variables:  
I have graylog 5. and noticed that it stopped working saying that Elastick search is out of space yet I have 400 G?b available in my HyperV Machine

### Indices blocked (triggered 12 hours ago)

7 indices are blocked.

- juniper345\_20: index.blocks.read\_only\_allow\_delete
- srx345\_49: index.blocks.read\_only\_allow\_delete
- gl-failures\_0: index.blocks.read\_only\_allow\_delete
- srx1500\_25: index.blocks.read\_only\_allow\_delete
- gl-events\_0: index.blocks.read\_only\_allow\_delete
- graylog\_0: index.blocks.read\_only\_allow\_delete
- gl-system-events\_0: index.blocks.read\_only\_allow\_delete

**3. What steps have you already taken to try and solve the problem?**

### Elasticsearch nodes disk usage above flood stage watermark (triggered 12 hours ago)

### Elasticsearch nodes disk usage above high watermark (triggered a day ago)

**4. How can the community help?**  
I have deleted all the .gz files in both elasticsearch and graylogs logs and rebooted and still am having the same issue. No data since October 7 th

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\
**Post date:** [October 19, 2023, 8:20am UTC](https://community.graylog.org/t/graylog-stopped-working-indice-blocked/30375/2 "2023-10-19T08:20:23Z")

</div>

You will need to drill down into how ES is allocating space to figure out why you keep exceeding the watermark.

Please refer to these docs:

> **[Fix watermark errors | Elasticsearch Guide \[8.10\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/fix-watermark-errors.html)**

> **[Cluster allocation explain API | Elasticsearch Guide \[8.10\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-allocation-explain.html)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 2, 2023, 8:21am UTC](https://community.graylog.org/t/graylog-stopped-working-indice-blocked/30375/3 "2023-11-02T08:21:21Z")

</div>

Closed on November 2, 2023, 8:21am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
