记一次es索引只读的异常处理

某一天发现，logstash一直在报错，

[2020-10-29T10:37:27,410][INFO ][logstash.outputs.elasticsearch] retrying failed
 action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"
blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2020-10-29T10:37:27,410][INFO ][logstash.outputs.elasticsearch] Retrying indivi
dual bulk actions that failed or were rejected by the previous bulk request. {:c
ount=>125}

查看了一下es服务器，发现是磁盘快满了，索引设置成为只读模式。文档表示存储硬盘超过95%，改索引会强制变成只读模式。
这个时候库用硬盘，并执行以下命令，

PUT _settings
{
  "index": {
    "blocks": {
      "read_only_allow_delete": "false"
    }
  }
}

欢迎访问个人博客