Both sides previous revisionPrevious revisionNext revision | Previous revision |
wiki:elasticsearch_troubleshooting [2022/09/30 14:18] – [See also] add link antisa | wiki:elasticsearch_troubleshooting [2023/02/28 15:02] (current) – [Unable to write to elasticsearch] add graylog index link antisa |
---|
| |
| |
Free some disk space and run this: | Free some disk space for example delete an old index (see howto for [[wiki:graylog_troubleshooting#elasticsearch_nodes_disk_usage_above_low_watermark|graylog index management]]) |
| |
| curl -X DELETE -u undefined:$ESPASS "localhost:9200/my-index?pretty" |
| |
| and run this: |
curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}' | curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}' |
| |
[[https://www.elastic.co/guide/en/elasticsearch/reference/6.2/disk-allocator.html|Check]] the docs for more info. | [[https://www.elastic.co/guide/en/elasticsearch/reference/6.2/disk-allocator.html|Check]] the docs for more info. |
| |
| ===== snapshot missing exception ===== |
| If you get an error like: |
| |
| "snapshot_missing_exception" |
| |
| Delete the snapshot repo |
| |
| curl -X DELETE -u undefined:$ESPASS "localhost:9200/_snapshot/es_backup?pretty" |
| |
| and try listing again. |
| |
| ===== index ... is the write index for the datastream ===== |
| When trying to delete the index like |
| |
| curl -XDELETE 'localhost:9200/.ds-.logs-deprecation.elasticsearch-default-2022.11.15-000001?pretty' |
| |
| you get |
| |
| <code> |
| { |
| "error" : { |
| "root_cause" : [ |
| { |
| "type" : "illegal_argument_exception", |
| "reason" : "index [.ds-.logs-deprecation.elasticsearch-default-2022.11.15-000001] is the write index for data stream [.logs-deprecation.elasticsearch-default] and cannot be deleted" |
| } |
| ], |
| "type" : "illegal_argument_exception", |
| "reason" : "index [.ds-.logs-deprecation.elasticsearch-default-2022.11.15-000001] is the write index for data stream [.logs-deprecation.elasticsearch-default] and cannot be deleted" |
| }, |
| "status" : 400 |
| } |
| |
| </code> |
| |
| you need to rollover to the new index, e.g. |
| |
| curl -s -X POST "localhost:9200/.logs-deprecation.elasticsearch-default/_rollover" |
| |
| and run delete command again. |
===== Tested on ===== | ===== Tested on ===== |
* Debian 10 | * Debian 10 |
* [[wiki:graylog_troubleshooting|Graylog troubleshooting]] | * [[wiki:graylog_troubleshooting|Graylog troubleshooting]] |
* [[wiki:elasticsearch_commands|Elasticsearch commands]] | * [[wiki:elasticsearch_commands|Elasticsearch commands]] |
| * [[wiki:kibana_troubleshooting|Kibana troubleshooting]] |
====== References ====== | ====== References ====== |
* https://www.datadoghq.com/blog/elasticsearch-unassigned-shards/ | * https://www.datadoghq.com/blog/elasticsearch-unassigned-shards/ |
* https://discuss.elastic.co/t/restore-of-elasticsearch-data-fails-with-corruptindexexception-checksum-failed-hardware-problem/261619/3 | * https://discuss.elastic.co/t/restore-of-elasticsearch-data-fails-with-corruptindexexception-checksum-failed-hardware-problem/261619/3 |
* https://stackoverflow.com/questions/50609417/elasticsearch-error-cluster-block-exception-forbidden-12-index-read-only-all | * https://stackoverflow.com/questions/50609417/elasticsearch-error-cluster-block-exception-forbidden-12-index-read-only-all |
| * https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-rollover-index.html |
| |