Differences

This shows you the differences between two versions of the page.

--- wiki:elasticsearch_troubleshooting [2022/10/10 13:37] – [See also] add Kibana troubleshooting antisa
+++ wiki:elasticsearch_troubleshooting [2023/02/28 15:02] (current) – [Unable to write to elasticsearch] add graylog index link antisa
@@ Line 119: / Line 119: @@
-Free some disk space and run this:
+Free some disk space for example delete an old index (see howto for [[wiki:graylog_troubleshooting#elasticsearch_nodes_disk_usage_above_low_watermark|graylog index management]])
+  curl -X DELETE -u undefined:$ESPASS "localhost:9200/my-index?pretty"
+ and run this:
   curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'
@@ Line 137: / Line 141: @@
 [[https://www.elastic.co/guide/en/elasticsearch/reference/6.2/disk-allocator.html|Check]] the docs for more info.
+===== snapshot missing exception =====
+If you get an error like:
+  "snapshot_missing_exception"
+Delete the snapshot repo
+  curl -X DELETE -u undefined:$ESPASS "localhost:9200/_snapshot/es_backup?pretty"
+and try listing again.
+===== index ... is the write index for the datastream =====
+When trying to delete the index like
+  curl -XDELETE 'localhost:9200/.ds-.logs-deprecation.elasticsearch-default-2022.11.15-000001?pretty'
+you get
+<code>
+{
+  "error" : {
+    "root_cause" : [
+      {
+        "type" : "illegal_argument_exception",
+        "reason" : "index [.ds-.logs-deprecation.elasticsearch-default-2022.11.15-000001] is the write index for data stream [.logs-deprecation.elasticsearch-default] and cannot be deleted"
+      }
+    ],
+    "type" : "illegal_argument_exception",
+    "reason" : "index [.ds-.logs-deprecation.elasticsearch-default-2022.11.15-000001] is the write index for data stream [.logs-deprecation.elasticsearch-default] and cannot be deleted"
+  },
+  "status" : 400
+}
+</code>
+you need to rollover to the new index, e.g.
+  curl -s -X POST "localhost:9200/.logs-deprecation.elasticsearch-default/_rollover"
+and run delete command again.
 ===== Tested on =====
   * Debian 10
@@ Line 150: / Line 194: @@
   * https://discuss.elastic.co/t/restore-of-elasticsearch-data-fails-with-corruptindexexception-checksum-failed-hardware-problem/261619/3
   * https://stackoverflow.com/questions/50609417/elasticsearch-error-cluster-block-exception-forbidden-12-index-read-only-all
+  * https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-rollover-index.html