elasticsearch Elasticsearch不接受数据
我在kubernetes上有一个Elasticsearch集群。最近,logstash无法将任何数据推送到集群,因为集群中的一个节点磁盘空间不足 这就是logstash中的错误elasticsearch Elasticsearch不接受数据,elasticsearch,logstash,elasticsearch,Logstash,我在kubernetes上有一个Elasticsearch集群。最近,logstash无法将任何数据推送到集群,因为集群中的一个节点磁盘空间不足 这就是logstash中的错误 [Ruby-0-Thread-13@[main]>worker1: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:383] elasticsearch - retrying failed action with response co
[Ruby-0-Thread-13@[main]>worker1: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:383] elasticsearch - retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})
es主机已将节点标记为只读,因为可用磁盘空间超过阈值
[WARN ][o.e.c.r.a.DiskThresholdMonitor] [es-master-65ccf55794-pm4xz] flood stage disk watermark [95%] exceeded on [SaRCGuyyTBOxTjNtvjui-g][es-data-1][/data/data/nodes/0] free: 9.1gb[2%], all indices on this node will be marked read-only
在此之后,我释放了该节点上的资源,现在它有足够的可用空间(几乎50%)。但是logstash仍然无法将数据推送到弹性搜索,并且正在记录上面相同的错误
我有以下问题
您必须手动重置索引上的只读块 您可以在
cluster.routing.allocation.disk.watermark.flood\u stage
块中查看文档
一旦有足够的磁盘,必须手动释放索引块
允许继续索引操作的可用空间
PUT/\u设置
{
“index.blocks.read\u only\u allow\u delete”:null
}
这是所有索引的设置方式:curl-XPUT-H“Content-Type:application/json”http://localhost:9200/_all/_settings -d'{“index.blocks.read\u only\u allow\u delete:null}'
PUT /<your index name>/_settings
{
"index.blocks.read_only_allow_delete": null
}