ELK|es `Reload field list` 报错


nginx的日志新加了一个字段,但是kinaba查询的时候显示不出来,习惯性的去更新nginx的索引Refresh fields.

结果出现了下面的报错

blocked by: 
[FORBIDDEN/12/index read-only / allow delete (api)];
[cluster_block_exception] blocked by:
[FORBIDDEN/12/index read-only / allow delete (api)];


看样子是有index因为某些原因,现在read_only了.
查询一下

GET */_settings?filter_path=**.read_only_allow_delete

{
  "nginx-2020.04.28": {
    "settings": {
      "index": {
        "blocks": {
          "read_only_allow_delete": "true"
        }
      }
    }
  },
  ...
}

果然有,想起昨天的时候,es磁盘空间有告警不足,估计是当时引起的,找到根源解决就很简单了.

解决

PUT _settings
{
  "index": {
    "blocks": {
      "read_only_allow_delete": null
    }
  }
}

#! Deprecation: [_all] is deprecated in 6.0+ and will be removed in 7.0. As a replacement, you can use [copy_to] on mapping fields to create your own catch all field.
{
  "acknowledged": true
}

oh,对,我当前的es环境是6.0.0,kinaba也是6.0.0


相关博文

About rainbird

IOS攻城狮
This entry was posted in ELK and tagged , , , , , . Bookmark the permalink.

发表评论