ElasticSearch报错blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]

org.elasticsearch.ElasticsearchStatusException: Elasticsearch exception [type=cluster_block_exception, reason=blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];]
	at org.elasticsearch.rest.BytesRestResponse.errorFromXContent(BytesRestResponse.java:177)
	at org.elasticsearch.client.RestHighLevelClient.parseEntity(RestHighLevelClient.java:2053)
	at org.elasticsearch.client.RestHighLevelClient.parseResponseException(RestHighLevelClient.java:2030)
	at org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1777)
	at org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1734)
	at org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1696)
	at org.elasticsearch.client.RestHighLevelClient.update(RestHighLevelClient.java:998)



Suppressed: org.elasticsearch.client.ResponseException: method [POST], host [http://127.0.0.1:9200], URI [/ks_crm_leads/_doc/8/_update?doc_as_upsert=true&timeout=1m], status line [HTTP/1.1 403 Forbidden]
{"error":{"root_cause":[{"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}],"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"},"status":403}
		at org.elasticsearch.client.RestClient$SyncResponseListener.get(RestClient.java:936)
		at org.elasticsearch.client.RestClient.performRequest(RestClient.java:233)
		at org.elasticsearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1764)
		... 122 common frames omitted
	Caused by: org.elasticsearch.client.ResponseException: method [POST], host [http://127.0.0.1:9200], URI [/ks_crm_leads/_doc/8/_update?doc_as_upsert=true&timeout=1m], status line [HTTP/1.1 403 Forbidden]
{"error":{"root_cause":[{"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"}],"type":"cluster_block_exception","reason":"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"},"status":403}
		at org.elasticsearch.client.RestClient$1.completed(RestClient.java:552)
		at org.elasticsearch.client.RestClient$1.completed(RestClient.java:537)
		at org.apache.http.concurrent.BasicFuture.completed(BasicFuture.java:122)
		at org.apache.http.impl.nio.client.DefaultClientExchangeHandlerImpl.responseCompleted(DefaultClientExchangeHandlerImpl.java:181)

根据错误信息,是索引只有只读和删除权限,解决方法:

curl -XPUT -H ‘Content-Type: application/json’ http://127.0.0.1:9200/_all/_settings -d ’
{
"index": {
  "blocks": {
     "read_only_allow_delete": "false"
     }
  }
}’

或者用PostMan

注意要设置头信息 Content-Type: application/json

 发现还是有问题:

[2022-09-09T18:11:46,807][WARN ][o.e.c.r.a.DiskThresholdMonitor] [7bF6q4C] flood stage disk watermark [95%] exceeded on [7bF6q4CdQvmTvsGIFEVJPg][7bF6q4C][G:\soft\elasticsearch-6.8.6\data\nodes\0] free: 4.6gb[3.5%], all indices on this node will be marked read-only

磁盘空间不足,清理磁盘,重新运行ES问题解决

<think>我们正在处理用户关于Elasticsearch修改数据时报错FORBIDDEN/12/index read-only / allow delete (api)”的问题。根据引用内容,该错误通常是由于磁盘空间不足导致Elasticsearch将索引设置为只读模式(只允许删除操作,不允许写入和修改)。以下是解决步骤和详细说明: ### 问题原因 当Elasticsearch集群的磁盘使用率超过95%时,系统会自动将索引设置为只读模式(`read_only_allow_delete`),此时任何写入操作(包括索引修改)都会被拒绝,并返回`403 FORBIDDEN`错误[^2][^5]。 ### 解决方案 #### 1. **检查磁盘空间** - 使用以下命令查看集群磁盘使用情况: ```bash GET _cat/allocation?v ``` 或 ```bash GET _cat/nodes?v&h=name,disk.avail,disk.used,disk.percent,disk.total ``` - 如果磁盘使用率超过95%,则触发只读模式[^5]。 #### 2. **清理磁盘空间(根本解决)** - **删除无用数据**:移除不再需要的索引或文档。 ```bash # 删除整个索引 DELETE /unused_index # 按条件删除文档 POST /your_index/_delete_by_query { "query": { "range": { "timestamp": { "lte": "now-365d" } } } } ``` - **扩容磁盘**:增加磁盘容量或添加新节点。 #### 3. **临时禁用只读模式(应急)** - 若需立即恢复写入,可临时关闭只读模式(需确保磁盘空间不足问题已在处理中): ```bash # 关闭所有索引的只读模式 PUT */_settings { "index.blocks.read_only_allow_delete": null } ``` 或针对特定索引操作: ```bash PUT /your_index/_settings { "index.blocks.read_only_allow_delete": null } ``` > **注意**:此操作仅临时解除限制,若磁盘空间未释放,后续仍会触发只读模式[^4][^5]。 #### 4. **调整水位线阈值(可选)** - 修改`elasticsearch.yml`配置文件,提高触发只读模式的阈值(如从95%调整至97%),但需谨慎: ```yaml cluster.routing.allocation.disk.watermark.flood_stage: 97% ``` - 动态更新设置: ```bash PUT _cluster/settings { "persistent": { "cluster.routing.allocation.disk.watermark.flood_stage": "97%" } } ``` > **警告**:此操作可能导致磁盘写满,仅建议在监控完善的环境中使用[^5]。 ### 预防措施 - **监控磁盘使用率**:通过Elasticsearch、Kibana或第三方工具设置磁盘告警。 - **定期清理旧数据**:使用ILM(Index Lifecycle Management)自动滚动删除旧索引。 - **扩容规划**:当磁盘使用率超过80%时,及时扩容。 ### 操作流程总结 ```mermaid graph TD A[出现FORBIDDEN/12错误] --> B{检查磁盘使用率} B -->|≥95%| C[清理磁盘空间] C --> D[删除旧索引/数据] C --> E[磁盘扩容] B -->|<95%| F[检查其他原因] A --> G[临时禁用只读模式] G --> H[PUT ..._settings] ``` ### 引用验证 - 引用[2][3][4][5]均指出磁盘空间不足是导致索引进入只读模式的主因,解决方案包括清理磁盘和临时调整设置。 - 引用[4]提供了临时关闭只读模式的API命令。 --- §§相关问题§§ 1. Elasticsearch的磁盘水位线机制具体如何运作? 2. 如何配置Elasticsearch的索引生命周期管理(ILM)实现自动清理? 3. 除了磁盘空间,还有哪些情况会导致Elasticsearch索引变为只读? 4. 如何监控Elasticsearch集群的磁盘使用情况? [^1]: 报错 blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];ElasticSearch 报错_caused by: org.elasticsearch.cluster.block.cluster-优快云博客 [^2]: Elasticsearch reason:index [xxx] blocked by: [FORBIDDEN/12/index read-only / allow del [^3]: ES报错 [FORBIDDEN/12/index read-only / allow delete (api)] - read only elasticsearch indices [^4]: ES 写索引报错 FORBIDDEN/12/index read-only / allow delete (api)解决方案 [^5]: 解决elasticsearch报错FORBIDDEN/12/index read-only / allow delete (api)</think>### Elasticsearch 索引只读报错FORBIDDEN/12)解决方案 根据引用内容,该错误是由于磁盘空间不足触发的Elasticsearch保护机制。以下是具体解决步骤: --- ### 一、核心原因分析 1. **磁盘空间不足** - Elasticsearch在磁盘使用率超过95%时自动将索引设为只读模式(`read_only_allow_delete`)[^2][^5] - 错误特征:`blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]` 2. **磁盘水位线规则** | 磁盘使用率 | 影响 | |------------|------| | ≥85% | 新分片无法分配 | | ≥90% | 分片迁移至低负载节点 | | ≥95% | **强制开启只读模式**(仅允许查询/删除)[^5] | --- ### 二、逐步解决方案 #### ▶ 第一步:检查磁盘状态 ```bash # 查看集群磁盘使用率 GET _cat/allocation?v # 检查节点磁盘详情 GET _cat/nodes?v&h=name,disk.used,disk.avail,disk.percent ``` - **关键指标**:`disk.percent ≥ 95` 的节点需优先处理[^5] #### ▶ 第二步:紧急恢复写入(临时方案) ```bash # 关闭所有索引的只读模式 PUT */_settings { "index.blocks.read_only_allow_delete": null } # 或针对特定索引操作 PUT /your_index_name/_settings { "index.blocks.read_only_allow_delete": null } ``` > ⚠️ 注意:此操作仅临时解除限制,需在**30分钟内**完成磁盘清理[^4] #### ▶ 第三步:释放磁盘空间(根本解决) 1. **删除无用数据** ```bash # 删除整个索引 DELETE /old_index_* # 按条件删除文档 POST /your_index/_delete_by_query { "query": { "range": { "@timestamp": { "lte": "now-365d" } } } } ``` 2. **扩容磁盘** - 增加节点磁盘容量 - 添加新数据节点分担负载 #### ▶ 第四步:调整水位线(预防) ```bash PUT _cluster/settings { "persistent": { "cluster.routing.allocation.disk.watermark.low": "85%", "cluster.routing.allocation.disk.watermark.high": "90%", "cluster.routing.allocation.disk.watermark.flood_stage": "95%" # 触发只读的阈值 } } ``` > 建议值:生产环境保持`flood_stage ≤ 93%`[^5] --- ### 三、预防措施 1. **设置监控告警** - 对`disk.percent ≥ 80%` 触发告警 2. **启用ILM自动清理** ```json PUT _ilm/policy/auto_clean_policy { "policy": { "phases": { "hot": { "min_age": "0ms", "actions": {} }, "delete": { "min_age": "30d", "actions": { "delete": {} } } } } } ``` 3. **定期执行存储优化** ```bash # 强制合并分段减少存储 POST /your_index/_forcemerge?max_num_segments=1 ``` --- ### 操作流程总结 ```mermaid graph LR A[报错 FORBIDDEN/12] --> B{检查磁盘使用率} B -->|≥95%| C[临时关闭只读模式] C --> D[立即清理磁盘数据] D --> E[扩容或调整水位线] B -->|<95%| F[检查其他原因] ``` > **重要提示**:临时关闭只读模式后,若未在1小时内释放磁盘空间,Elasticsearch会**再次自动开启只读保护**,导致写入中断[^5]。 ---
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值