0x00 Event

[2019-09-24T19:22:31,655][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2019-09-24T19:22:31,655][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2019-09-24T19:22:31,655][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
[2019-09-24T19:22:31,655][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

0x01 Solution

$ curl -XPUT -H 'Content-Type: application/json' http://192.168.1.146:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

Official Solution:
https://www.elastic.co/guide/en/elasticsearch/reference/6.4/disk-allocator.html

Elasticsearch 未能接收日志问题

原文：https://www.cnblogs.com/nnylee/p/11672928.html