记一个elk异常处理

2019独角兽企业重金招聘Python工程师标准>>>

1、kibana现象一直没看到有数据进来，怀疑是不是logstash挂了

2、查看logstash日志发现

[INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

3、查找、分析

报错关键index read-only/allow delete，查阅相关资料是ES配置read_only_allow_delete设置为true了，

通过kibana dev tools GET _settings调用api看到每个索引的read_only_allow_delete都是true

GET _settings 

4、解决

PUT _settings 
{   
    "index": {
         "blocks": {
             "read_only_allow_delete": "false"
         }   
    } 
}

 

转载于:https://my.oschina.net/u/565351/blog/3003381