解决LogStash报错：FORBIDDEN/12/index read-only / allow delete (api)

最新推荐文章于 2025-07-03 09:48:22 发布

原创

最新推荐文章于 2025-07-03 09:48:22 发布 · 1.2k 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#es #kibana

本文介绍了解决Logstash因Elasticsearch进入只读模式而导致数据无法写入的问题。详细记录了从发现错误信息、分析原因到最终解决的全过程，并提供了具体的步骤。

一、现象

在Kibana上一直查询不到索引最新插入的数据，通过排查发现

Logstash 的日志(/logs/logstash-plain.log) 大量报错：FORBIDDEN/12/index read-only / allow delete (api)

[2020-10-27T15:35:12,119][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"index [index_user_info] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2020-10-27T15:35:12,119][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"index [index_user_info] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2020-10-27T15:35:12,119][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"index [index_user_info] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2020-10-27T15:35:12,119][INFO ]