Indices blocked

1. Describe your incident:

Hi. I have a problem with Blocked Indices. Recently my disk was overflowing and I deleted several GB of stored data. Now the disk is 50% full, but the logs are not writing at all, because there is a problem like the one at the bottom in the picture. How to “unlock” Indices?

2. Describe your environment:

  • OS Information: Ubuntu 20.04.4 LTS

  • Package Version: Graylog 4.3.3+86369d3 on graylog (Private Build 1.8.0_312 on Linux 5.4.0-122-generic)

Elastic Search has set the indices to read_only due to exceeding high disk water mark.
You can find a number of threads in the forum discussing this, e.g.

1 Like


curl -XPUT -H “Content-Type: application/json” https://localhost:9200/_all/_settings -d ‘{“index.blocks.read_only_allow_delete”: null}’

after clearing the disk, this command allowed me to unlock the indices.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.