Indices blocked

[PustyB]

1. Describe your incident:

Hi. I have a problem with Blocked Indices. Recently my disk was overflowing and I deleted several GB of stored data. Now the disk is 50% full, but the logs are not writing at all, because there is a problem like the one at the bottom in the picture. How to “unlock” Indices?

2. Describe your environment:

• OS Information: Ubuntu 20.04.4 LTS

• Package Version: Graylog 4.3.3+86369d3 on graylog (Private Build 1.8.0_312 on Linux 5.4.0-122-generic)

[patrickmann]

Elastic Search has set the indices to read_only due to exceeding high disk water mark.
You can find a number of threads in the forum discussing this, e.g.

Graylog stopped with timeout

This depends on if your Graylog server resides on physical hardware or if its on a virtual machine. If its hardware either you need a new HDD and clone you graylog server to the larger drive, if your current dive has more space you can extend the portion. If your Graylog server is on a virtual machine it easy to add more space to the drive. Once you increase the volume you then need to add it to the correct portion on the Graylog server. https://help.ubuntu.com/stable/ubuntu-help/disk-res…

[PustyB]

Thanks.

curl -XPUT -H “Content-Type: application/json” https://localhost:9200/_all/_settings -d ‘{“index.blocks.read_only_allow_delete”: null}’

after clearing the disk, this command allowed me to unlock the indices.