kibana新加索引模式提示403

问题分析

//新增索引模式提示异常
无法更新 UI 设置
Request failed with status code: 403

//索引模式设置默认提示异常
blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked

问题解决

link

• https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-allocator.html
• https://blog.csdn.net/jingyoushui/article/details/100690329

//查看.kibana关联的真实索引，可以看到是alias
get /.kibana
  ".kibana_1" : {
    "aliases" : {
      ".kibana" : { }
    },
    ....

//查看已经关联的索引模式
get /.kibana/_search
{
  "query": {
    "term": {
      "type": {
        "value": "index-pattern"
      }
    }
  }
}

//打开.kibana索引写操作，问题得到有效解决
put /.kibana/_settings
{
  "index.blocks.read_only_allow_delete": "false"
}

本质上一旦设置只读，必须人工打开才可以的.清理磁盘空间