Index Patterns Cannot Be Created for an Elasticsearch Cluster

Symptom

On the Dev Tools page of Kibana, run the GET .kibana/_settings command to query the status of the .kibana index. The value of the parameter read_only_allow_delete is true, which indicates that the cluster disk usage is too high.

Possible Cause

When the .kibana index becomes read-only, new index patterns cannot be created.

Solution

1. Log in to Kibana.
   1. Log in to the CSS management console.
   2. In the navigation pane on the left, choose Clusters > Elasticsearch.
   3. In the cluster list, find the target cluster, and click Kibana in the Operation column to log in to the Kibana console.
   4. In the left navigation pane, choose Dev Tools.

      The left part of the console is the command input box, and the triangle icon in its upper-right corner is the execution button. The right part shows the execution result.

2. Run the following command to change the read_only_allow_delete parameter to false.

   PUT .kibana/_settings
   {
       "index": {
           "blocks": {
               "read_only_allow_delete": false
           }
       }
   }

3. Try creating new index patterns again.