No Information into Anlytics –> Discover

Symptom

When you try to visualize the data in OpenNac dashboard Analytics –> Discover there’s no data. You can confirm the issue checking the logstash file, some messages as follows can appear

[logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

You can certify the issue doing a query into elastic:

GET /_cluster/state?pretty

With the output sheck if some index are in ro

Solve

Could be the disk space into Analytics server, so you can free some space or add more disk space, and later run the following:

PUT .kibana/_settings
{
"index.blocks.read_only_allow_delete": null
}

PUT opennac_ud/_settings
{
"index.blocks.read_only_allow_delete": null
}

PUT logstash-*/_settings
{
"index.blocks.read_only_allow_delete": null
}

PUT opennac-*/_settings
{
"index.blocks.read_only_allow_delete": null
}