仅使用以下命令更改设置在我的环境中不起作用:

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

我还必须运行强制合并API命令:

curl -X POST "localhost:9200/my-index-000001/_forcemerge?pretty"

参考:强制合并API

从PostMan中删除只读设置

当您的机器磁盘空间不足时，通常会观察到此错误。 要避免此错误消息所遵循的步骤

Resetting the read-only index block on the index: $ curl -X PUT -H "Content-Type: application/json" http://127.0.0.1:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}' Response ${"acknowledged":true} Updating the low watermark to at least 50 gigabytes free, a high watermark of at least 20 gigabytes free, and a flood stage watermark of 10 gigabytes free, and updating the information about the cluster every minute Request $curl -X PUT "http://127.0.0.1:9200/_cluster/settings?pretty" -H 'Content-Type: application/json' -d' { "transient": { "cluster.routing.allocation.disk.watermark.low": "50gb", "cluster.routing.allocation.disk.watermark.high": "20gb", "cluster.routing.allocation.disk.watermark.flood_stage": "10gb", "cluster.info.update.interval": "1m"}}' Response ${ "acknowledged" : true, "persistent" : { }, "transient" : { "cluster" : { "routing" : { "allocation" : { "disk" : { "watermark" : { "low" : "50gb", "flood_stage" : "10gb", "high" : "20gb" } } } }, "info" : {"update" : {"interval" : "1m"}}}}}

运行这两个命令后，必须再次运行第一个命令，以使索引不会再次进入只读模式

仅使用以下命令更改设置在我的环境中不起作用:

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

我还必须运行强制合并API命令:

curl -X POST "localhost:9200/my-index-000001/_forcemerge?pretty"

参考:强制合并API

默认情况下，当可用磁盘空间小于5%时，安装的Elasticsearch将进入只读模式。如果你看到类似这样的错误:

Elasticsearch:运输:运输::错误::禁止:[403] {"错误":{“root_cause”:[{“类型”:“cluster_block_exception”,“原因”:“封锁 [FORBIDDEN/12/index read-only / allow delete . (api)];“}],”类型”:“cluster_block_exception”:“被”、“原因: [FORBIDDEN/12/index read-only / allow delete (api)];“}”状态”:403}

或者在/usr/local/var/log/elasticsearch.log中可以看到类似的日志:

泛洪级磁盘水位[95%]超过上 [nCxquc7PTxKvs6hLkfonvg] [nCxquc7] [/ usr /地方/ var / lib / elasticsearch /节点/ 0] Free: 15.3gb[4.1%]，该节点上的所有索引将被标记为只读

可以通过以下命令进行修复:

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_cluster/settings -d '{ "transient": { "cluster.routing.allocation.disk.threshold_enabled": false } }'
curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

即使计算机存储恢复到95%以上，这个问题仍然存在。

短期解决方案是将基巴纳上限提高到95%以上。此解决方案仅适用于Windows。

a. Create a json file with following parameters


{
  "persistent": {
    "cluster.routing.allocation.disk.watermark.low": "90%",
    "cluster.routing.allocation.disk.watermark.high": "95%",
    "cluster.routing.allocation.disk.watermark.flood_stage": "97%"
  }
}

b.Name it anything ,e.g : json.txt

c.Type following command in command prompt

>curl -X PUT "localhost:9200/_cluster/settings?pretty" -H "Content-Type: application/json" -d @json.txt

d.Following output is received.

{
  "acknowledged" : true,
  "persistent" : {
    "cluster" : {
      "routing" : {
        "allocation" : {
          "disk" : {
            "watermark" : {
              "low" : "90%",
              "flood_stage" : "97%",
              "high" : "95%"
            }
          }
        }
      }
    }
  },
  "transient" : { }
}

e.Create another json file with following parameter


{
  "index.blocks.read_only_allow_delete": null
}

f.Name it anything ,e.g : json1.txt

g.Type following command in command prompt

>curl -X PUT "localhost:9200/*/_settings?expand_wildcards=all" -H "Content-Type: application/json" -d @json1.txt

h.You should get following output

{"acknowledged":true}

i.Restart ELK stack/Kibana and the issue should be resolved.