背景

今天线上elk的数据太多，服务器的空间不足了。所以打算删除一些没用用的数据。我是用下面的request：

POST /{index_name}/_delete_by_query?wait_for_completion=false
{"query": {"bool": {"must": {"match": {"loglevel": "DEBUG"}}}}
}

但是出错了。
{ _index: ‘’,
_type: ‘type’,
_id: ‘record id’,
status: 403,
error:
{ type: ‘cluster_block_exception’,
reason: ‘blocked by: [FORBIDDEN/8/index write (api)];’ } }

导致原因：

（都是比较简单的英文，我就直接粘贴过来了）：
相关帖子

from reaching red or yellow status. It does this using index.blocks.write.

The two reasons being:

Low Memory

When the JVMMemoryPressure metric exceeds 92% for 30 minutes, Amazon ES triggers a protection mechanism and blocks all write operations to prevent the cluster from reaching red status. When the protection is on, write operations fail with a ClusterBlockException error, new indexes can’t be created, and the IndexCreateBlockException error is thrown.

When the JVMMemoryPressure metric returns to 88% or lower for five minutes, the protection is disabled, and write operations to the cluster are unblocked.

Low Disk Space

Elasticsearch has a default “low watermark” of 85%, meaning that once disk usage exceeds 85%, Elasticsearch no longer allocates shards to that node. Elasticsearch also has a default “high watermark” of 90%, at which point it attempts to relocate shards to other nodes.

官网对index.blocks.write参数的描述：

https://www.elastic.co/guide/en/elasticsearch/reference/6.0/index-modules.html#dynamic-index-settings

解决方法：

https://sease.io/2022/06/elasticsearch-disk-space-issue-and-rollover-solution.html
disale index.blocks.write.

PUT /[_all|<your_index_name>]/_settings
{"index.blocks.write": null
}

然后再重试之前的删除请求。