[FORBIDDEN/12/index read-only / allow delete (api)] - read only elasticsearch indices
Analysis
If your elasticsearch is responding with 403 and this message
{ "type": "cluster_block_exception", "reason": "blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];" }
Reason
The thing is, elasticsearch is switching to read-only if it cannot index more documents because your hard drive is full.
so that it switches for read-only queries and cannot allocate shards.
Solution
curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'
If you are using traefik in your app, then try below as an example
curl -XPUT -H "Content-Type: application/json" https://<your_application_url>/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'
Delete Kibana index
DELETE /.kibana/