DISK_WATERMARK_BLOCK elasticsearch resource_error ai_generated true

ClusterBlockException: 索引[my_index]被阻塞：[FORBIDDEN/12/index read-only / allow delete (api)]；节点[node-1]磁盘使用率超过阈值[95%]

ClusterBlockException: index [my_index] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]; disk usage exceeded threshold [95%] on node [node-1]

ID: elasticsearch/index-blocked-by-disk-threshold

其他格式: JSON · Markdown 中文 · English
85%修复率
90%置信度
1证据数
2023-08-25首次发现

版本兼容性

版本状态引入弃用备注
Elasticsearch 7.10 active — — —
Elasticsearch 8.0 active — — —
Elasticsearch 8.9 active — — —

根因分析

节点上的磁盘使用率超过了高水位线（默认95%），导致Elasticsearch阻止写入操作以防止数据丢失。

English

Disk usage on a node exceeded the high watermark (default 95%), causing Elasticsearch to block write operations to protect against data loss.

generic

官方文档

https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-usage-exceeded.html

解决方案

  1. 通过删除旧索引或移动数据释放磁盘空间：`POST _reindex {"source": {"index": "old_index"}, "dest": {"index": "new_index"}}` 然后删除旧索引
  2. 通过添加新节点或扩展存储增加磁盘容量，然后重新平衡分片：`PUT _cluster/settings {"transient": {"cluster.routing.rebalance.enable": "all"}}`
  3. 临时禁用磁盘分配决策器以允许写入：`PUT _cluster/settings {"transient": {"cluster.routing.allocation.disk.threshold_enabled": false}}`（谨慎使用）

无效尝试

常见但无效的做法:

  1. Manually removing the index block with `PUT my_index/_settings {"index.blocks.read_only_allow_delete": null}` without freeing disk space 90% 失败

    The block will be reapplied by the cluster when the next disk check runs, as disk usage remains high.

  2. Increasing the disk watermark thresholds in elasticsearch.yml (e.g., `cluster.routing.allocation.disk.watermark.high: 98%`) 70% 失败

    This only delays the problem and risks data loss if disk fills completely.

  3. Deleting the index entirely to free space 50% 失败

    This is a destructive action that may cause data loss; it should only be a last resort.