Indexers arent working

Graylog Central (peer support)
1

{“type”:“cluster_block_exception”,“reason”:“blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];”}

ubuntu@graylog:/etc$ df -h /home/
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/graylog–vg-root 19G 12G 5.6G 68% /

ubuntu@graylog:/etc$ sudo pvdisplay
— Physical volume —
PV Name /dev/sda1
VG Name graylog-vg
PV Size <19.53 GiB / not usable 2.00 MiB
Allocatable yes (but full)
PE Size 4.00 MiB
Total PE 4999
Free PE 0
Allocated PE 4999

2

check your log files why elasticsearch was made read-only and resolve that. after that make the index read-write again.

3

Im new to this, how do I perform the two tasks? Where is the log stored and how do I make the index read-write again?

4

Depending how you have installed the location might be different. But it is documented:

http://docs.graylog.org/en/3.0/pages/configuration/file_location.html

As you did not share any information about the versions, you would need to search the interweb how to remove the read only flag yourself.