[FORBIDDEN/12/index read-only / allow delete (api)] - read only elasticsearch indices

Analysis

If your elasticsearch is responding with 403 and this message

{ "type": "cluster_block_exception", "reason": "blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];" }

Reason

The thing is, elasticsearch is switching to read-only if it cannot index more documents because your hard drive is full.

so that it switches for read-only queries and cannot allocate shards.

Solution

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

If you are using traefik in your app, then try below as an example

curl -XPUT -H "Content-Type: application/json" https://<your_application_url>/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

Delete Kibana index

DELETE /.kibana/