Index Patterns Cannot Be Created for an Elasticsearch Cluster

Symptom

On the Dev Tools page of Kibana, run the GET .kibana/_settings command to query the status of the .kibana index. The value of the parameter read_only_allow_delete is true, which indicates that the cluster disk usage is too high.

Possible Cause

When the .kibana index becomes read-only, new index patterns cannot be created.

Solution

1. Log in to Kibana.
   1. Log in to the CSS management console.
   2. In the navigation pane on the left, choose Clusters > Elasticsearch.
   3. In the cluster list, find the target cluster, and click Kibana in the Operation column to log in to the Kibana console.
   4. In the left navigation pane, choose Dev Tools.
2. Run the following command to change the read_only_allow_delete parameter to false.

   PUT .kibana/_settings
   {
       "index": {
           "blocks": {
               "read_only_allow_delete": false
           }
       }
   }

3. Try creating new index patterns again.