Hi
I receive many errors as below:
Graylog - Indexer failures
{“type”:“cluster_block_exception”,“reason”:“blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];”}
and new messages are incoming to the graylog syslog srv but it does not keep them. How can I clear old logs to give space for the new one
he @wingreg
sorry that you run into this issue - but your index retention and rotation looks like it is not configured proper for the available disk space.
The solution and the answer to your question can be found in this community if you take your error messages (or parts of that) and put that into the search of this community you will find the answer in the first available topics.
Jan
Hi Jan
thank you for quick respolnse. I found some ntoes about elasticsearch engine etc. but unfortunately I am worse than beginner in Linux and without any tutorial it is hard for me to edit anything in graylog files:(
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.