elasticsearch resource_error ai_generated true

集群块异常：索引 [my_index] 被阻止：[FORBIDDEN/12/index read-only / allow delete (api)]；磁盘使用量超过洪水水位线

ClusterBlockException: index [my_index] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]; disk usage exceeded flood-stage watermark

ID: elasticsearch/index-read-only-due-to-disk-threshold

其他格式: JSON · Markdown 中文 · English
85%修复率
90%置信度
1证据数
2023-09-01首次发现

版本兼容性

版本状态引入弃用备注
7.17.10 active — — —
8.6.2 active — — —
8.11.0 active — — —

根因分析

节点上的磁盘使用量超过了洪水水位线（默认 95%），导致 Elasticsearch 自动将索引设置为只读以防止数据丢失。

English

The disk usage on a node has exceeded the flood-stage watermark (default 95%), causing Elasticsearch to automatically set the index to read-only to prevent data loss.

generic

官方文档

https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-allocator.html

解决方案

  1. 通过删除旧索引或将数据移动到其他节点释放磁盘空间：DELETE /old_logs_index-2024-01 或使用 ILM 滚动。然后移除块：PUT /my_index/_settings { "index.blocks.read_only_allow_delete": null }
  2. 为节点增加更多磁盘空间，或使用 Cluster Reroute API 将分片移动到有更多空间的节点：POST /_cluster/reroute { "commands": [{ "move": { "index": "my_index", "shard": 0, "from_node": "full_node", "to_node": "free_node" } }] }

无效尝试

常见但无效的做法:

  1. 95% 失败

    Without freeing disk space, the block will be re-applied by the disk threshold monitor within minutes.

  2. 80% 失败

    This only postpones the issue and risks running out of disk completely, causing data corruption.