Indexers arent working

{“type”:“cluster_block_exception”,“reason”:“blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];”}

ubuntu@graylog:/etc$ df -h /home/
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/graylog–vg-root 19G 12G 5.6G 68% /

ubuntu@graylog:/etc$ sudo pvdisplay
— Physical volume —
PV Name /dev/sda1
VG Name graylog-vg
PV Size <19.53 GiB / not usable 2.00 MiB
Allocatable yes (but full)
PE Size 4.00 MiB
Total PE 4999
Free PE 0
Allocated PE 4999

check your log files why elasticsearch was made read-only and resolve that. after that make the index read-write again.

Im new to this, how do I perform the two tasks? Where is the log stored and how do I make the index read-write again?

Depending how you have installed the location might be different. But it is documented:

http://docs.graylog.org/en/3.0/pages/configuration/file_location.html

As you did not share any information about the versions, you would need to search the interweb how to remove the read only flag yourself.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.