{
  "id": "elasticsearch/index-read-only-due-to-disk-threshold",
  "signature": "ClusterBlockException: index [my_index] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]; disk usage exceeded flood-stage watermark",
  "signature_zh": "集群块异常：索引 [my_index] 被阻止：[FORBIDDEN/12/index read-only / allow delete (api)]；磁盘使用量超过洪水水位线",
  "regex": "ClusterBlockException: index \\[.*?\\] blocked by: \\[FORBIDDEN/12/index read-only / allow delete \\(api\\)\\]",
  "domain": "elasticsearch",
  "category": "resource_error",
  "subcategory": null,
  "root_cause": "The disk usage on a node has exceeded the flood-stage watermark (default 95%), causing Elasticsearch to automatically set the index to read-only to prevent data loss.",
  "root_cause_type": "generic",
  "root_cause_zh": "节点上的磁盘使用量超过了洪水水位线（默认 95%），导致 Elasticsearch 自动将索引设置为只读以防止数据丢失。",
  "versions": [
    {
      "version": "7.17.10",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "8.6.2",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "8.11.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Without freeing disk space, the block will be re-applied by the disk threshold monitor within minutes.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "This only postpones the issue and risks running out of disk completely, causing data corruption.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Free disk space by deleting old indices or moving data to another node: DELETE /old_logs_index-2024-01 or use ILM to rollover. Then remove the block: PUT /my_index/_settings { \"index.blocks.read_only_allow_delete\": null }",
      "success_rate": 0.9,
      "how": "Free disk space by deleting old indices or moving data to another node: DELETE /old_logs_index-2024-01 or use ILM to rollover. Then remove the block: PUT /my_index/_settings { \"index.blocks.read_only_allow_delete\": null }",
      "condition": "",
      "sources": []
    },
    {
      "action": "Add more disk space to the node or move shards to nodes with more space using the Cluster Reroute API: POST /_cluster/reroute { \"commands\": [{ \"move\": { \"index\": \"my_index\", \"shard\": 0, \"from_node\": \"full_node\", \"to_node\": \"free_node\" } }] }",
      "success_rate": 0.85,
      "how": "Add more disk space to the node or move shards to nodes with more space using the Cluster Reroute API: POST /_cluster/reroute { \"commands\": [{ \"move\": { \"index\": \"my_index\", \"shard\": 0, \"from_node\": \"full_node\", \"to_node\": \"free_node\" } }] }",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "通过删除旧索引或将数据移动到其他节点释放磁盘空间：DELETE /old_logs_index-2024-01 或使用 ILM 滚动。然后移除块：PUT /my_index/_settings { \"index.blocks.read_only_allow_delete\": null }",
    "为节点增加更多磁盘空间，或使用 Cluster Reroute API 将分片移动到有更多空间的节点：POST /_cluster/reroute { \"commands\": [{ \"move\": { \"index\": \"my_index\", \"shard\": 0, \"from_node\": \"full_node\", \"to_node\": \"free_node\" } }] }"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-allocator.html",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.9,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2023-09-01",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}