Indices blocked

[patrickmann]

Elastic Search has set the indices to read_only due to exceeding high disk water mark.
You can find a number of threads in the forum discussing this, e.g.

Graylog stopped with timeout

This depends on if your Graylog server resides on physical hardware or if its on a virtual machine. If its hardware either you need a new HDD and clone you graylog server to the larger drive, if your current dive has more space you can extend the portion. If your Graylog server is on a virtual machine it easy to add more space to the drive. Once you increase the volume you then need to add it to the correct portion on the Graylog server. https://help.ubuntu.com/stable/ubuntu-help/disk-res…