index_read_only_allow_delete: TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage watermark, index has read-only-allow-delete block (legacy: FORBIDDEN/12/index read-only / allow delete (api))

What does it mean?

The index is read-only because index.blocks.read_only_allow_delete is true; new documents cannot be written or updated, only the index can be deleted. Elasticsearch usually sets this automatically when the disk flood stage watermark is exceeded; ES 8.x returns HTTP 429 to write requests.

Why does it happen?

The block was set automatically because disk usage exceeded the flood stage threshold, or the setting was set to true manually. If the block is removed without freeing disk space, Elasticsearch reapplies it.

How to fix it

Free up sufficient disk space. In 7.4+, an automatically set block clears itself when disk usage drops below the high watermark; for a manually set block, or to clear it without waiting, remove the block: PUT /_all/_settings {"index.blocks.read_only_allow_delete": null}. For a single index: PUT /index-name/_settings {"index.blocks.read_only_allow_delete": null}. If it keeps recurring, increase disk capacity, set up an ILM policy and monitor which node is filling up with _cat/allocation.