背景

今天线上elk的数据太多，服务器的空间不足了。所以打算删除一些没用用的数据。我是用下面的request：

复制代码

POST /{index_name}/_delete_by_query?wait_for_completion=false
{
  "query": {
    "bool": {
      "must": {
        "match": {
          "loglevel": "DEBUG"
        }
      }
    }
  }
}

但是出错了。

{ _index: '',

_type: 'type',

_id: 'record id',

status: 403,

error:

{ type: 'cluster_block_exception',

reason: 'blocked by: $FORBIDDEN/8/index write (api)$ ;' } }

导致原因：

（都是比较简单的英文，我就直接粘贴过来了）：
相关帖子

from reaching red or yellow status. It does this using index.blocks.write.

The two reasons being:

Low Memory

When the JVMMemoryPressure metric exceeds 92% for 30 minutes, Amazon ES triggers a protection mechanism and blocks all write operations to prevent the cluster from reaching red status. When the protection is on, write operations fail with a ClusterBlockException error, new indexes can't be created, and the IndexCreateBlockException error is thrown.

When the JVMMemoryPressure metric returns to 88% or lower for five minutes, the protection is disabled, and write operations to the cluster are unblocked.

Low Disk Space

Elasticsearch has a default "low watermark" of 85%, meaning that once disk usage exceeds 85%, Elasticsearch no longer allocates shards to that node. Elasticsearch also has a default "high watermark" of 90%, at which point it attempts to relocate shards to other nodes.

官网对index.blocks.write参数的描述：

https://www.elastic.co/guide/en/elasticsearch/reference/6.0/index-modules.html#dynamic-index-settings

解决方法：

https://sease.io/2022/06/elasticsearch-disk-space-issue-and-rollover-solution.html

disale index.blocks.write.

复制代码

PUT /[_all|<your_index_name>]/_settings
{
  "index.blocks.write": null
}

然后再重试之前的删除请求。