Indexer Failures NEW

[DaxiDriver (DaxiDriveee)]

Hi
GrayLog worked fine. SUDDENLY - i get this error
{“type”:“cluster_block_exception”,“reason”:“blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];”}

and no new data is showing

please advise

thank you

[jan (Jan Doberstein)]

make your indices writable again.

multiple solutions:

• remove data from your ES Servers
• add more disk space to ES Servers

After the above is done, make the indices writable again.

This happens if the high/low watermark is reached. That is visible in your Elasticsearch logfile.

[DaxiDriver (DaxiDriveee)]

Thank you - i use graylog 3 - all in 1
i dont have ES servers
can you please provide a link on how to delet data from gray log ? or like - save only last 7 days log ?

thank you

[jan (Jan Doberstein)]

There is no additional link with a copy&paste howto - at least I did not know any.

You need to delete some indices to free up space: https://www.elastic.co/guide/en/elasticsearch/reference/6.7/indices-delete-index.html

After that configure your data retention and rotation in Graylog that it fits your available disk space or time you want to data to be persistent. Remember that for the second one you need the amount of disk space for that. https://docs.graylog.org/en/stable/pages/configuration/index_model.html#index-set-configuration

If that is done, make your indices read-write again:

 curl -XPUT -H "Content-Type: application/json"  https://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

[DaxiDriver (DaxiDriveee)]

thank you
how do i \ where i cna run this
curl -XPUT -H “Content-Type: application/json” https://localhost:9200/_all/_settings -d ‘{“index.blocks.read_only_allow_delete”: null}’

?

thank you