解决kibana无法保存discover搜索的问题

最近在使用kibana时，发现无法保存discover的搜索结果。

 

提示如下：

百思不得其解，以前好好的，现在不行了。只好查询日志，顺藤摸瓜。日志中有提示：

log   [06:09:41.598] [error][task_manager] Failed to poll for work: [cluster_block_exception] index [.kibana_task_manager] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]; :: {"path":"/.kibana_task_manager/_update/Maps-maps_telemetry","query":{"if_seq_no":72,"if_primary_term":15,"refresh":"true"},"body":"{\"doc\":{\"type\":\"task\",\"task\":{\"taskType\":\"maps_telemetry\",\"state\":\"{\\\"runs\\\":1,\\\"stats\\\":{\\\"mapsTotalCount\\\":0,\\\"timeCaptured\\\":\\\"2020-08-10T16:00:00.815Z\\\",\\\"attributesPerMap\\\":{\\\"dataSourcesCount\\\":{\\\"min\\\":0,\\\"max\\\":0,\\\"avg\\\":0},\\\"layersCount\\\":{\\\"min\\\":0,\\\"max\\\":0,\\\"avg\\\":0},\\\"layerTypesCount\\\":{},\\\"emsVectorLayersCount\\\":{}}}}\",\"params\":\"{}\",\"attempts\":0,\"scheduledAt\":\"2020-08-10T10:00:11.623Z\",\"runAt\":\"2021-08-05T06:10:41.596Z\",\"status\":\"running\"},\"kibana\":{\"uuid\":\"eed5fdcc-dc0a-4ba0-acaf-0c631aa6456d\",\"version\":7030099,\"apiVersion\":1}}}","statusCode":403,"response":"{\"error\":{\"root_cause\":[{\"type\":\"cluster_block_exception\",\"reason\":\"index [.kibana_task_manager] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"}],\"type\":\"cluster_block_exception\",\"reason\":\"index [.kibana_task_manager] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"},\"status\":403}"}

  log   [06:09:44.709] [warning] Error loading maps telemetry: [cluster_block_exception] index [.kibana_2] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]; :: {"path":"/.kibana/_doc/maps-telemetry%3Amaps-telemetry","query":{"refresh":"wait_for"},"body":"{\"maps-telemetry\":{\"mapsTotalCount\":0,\"timeCaptured\":\"2021-08-05T06:09:44.707Z\",\"attributesPerMap\":{\"dataSourcesCount\":{\"min\":0,\"max\":0,\"avg\":0},\"layersCount\":{\"min\":0,\"max\":0,\"avg\":0},\"layerTypesCount\":{},\"emsVectorLayersCount\":{}}},\"type\":\"maps-telemetry\",\"updated_at\":\"2021-08-05T06:09:44.707Z\"}","statusCode":403,"response":"{\"error\":{\"root_cause\":[{\"type\":\"cluster_block_exception\",\"reason\":\"index [.kibana_2] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"}],\"type\":\"cluster_block_exception\",\"reason\":\"index [.kibana_2] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];\"},\"status\":403}"}

 大概是提示有一些索性是只读状态。其中有个特别的单词：FORBIDDEN。正好界面上操作报错也是forbidden，猜想可能有关联。但是这两个索引我没有创建过。点开头的，查询出来是系统索引。

在索引管理里面，勾选上包含系统索引，则看到了一个名为.kibana_task_manager的和 .kibana_2的索引。点击对应名称，看到编辑项，

里面的"index.blocks.read_only_allow_delete"目前是true，说明是只读。设置成false后，保存。

再去discover中保存搜索结果，这个时候提示成功了。

我操作了几个系统索引，发现 是.kibana_2这个索引，影响了discover里面能否保存搜索结果。

该索引的更多作用，正在探索中。