PaloAltoNetworks/SafeNetworking

TransportError - cluster_block_exception when updating index

punisherVX opened this issue · 1 comments

When trying to update an existing document in any index, the following error is thrown and the system keeps retrying the same thing over and over:

[ERROR]   : 2019-05-09 17:30:50,325 : dnsutils:updateAfStats:[54]:139996463884032   : TransportError(403, 'cluster_block_exception', 'blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];')

This is especially wasteful on the sfn-domain-details index because none of the expired cache documents can be updated and we use points to continually ask AF for the info but can't write it.

This can be fixed during setup by adjusting the settings on each index to allow for deletions using

PUT af-details/_settings
{
  "index": {
    "blocks": {
        "read_only_allow_delete": "false"
    }
  }
}