走过岁月......

报错内容

Health Check. 3002 - [cluster_block_exception] index [.wazuh] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)]; (/api/check-stored-api)

原因：一旦在存储超过95％的磁盘中的节点上分配了一个或多个分片的任何索引，该索引将被强制进入只读模式

解决：

# curl -XPUT -H "Content-Type: application/json" https://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": false}'

或

# curl -XPUT -H "Content-Type: application/json" https://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null'

OK!