Kibana Metricbeat, Packetbeat and Filebeat no data showing index is readonly

Ever had the case where you stop seeing data in elasticsearch via kibana?

You might see something like the above.

Perhaps your server ran out of disk space needed to run the instance…if that is the case your index has probably gone read only.

Check your logs:

journalctl -e logstash

if you see this result:

retrying failed action with response code: 403 ({"type"=>"cluster_block_exception", "reason"=>"blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];"})

then we need to unlock the index, which can be done with the API or with Kibana:

In Kibana go to Management -> index Management:

Or make json allow.json:

{
  "index": {
    "blocks": {
      "read_only_allow_delete": "false" 
    }
  }
}

then make the following request:

http put :9200/-*/_settings < allow_delete.json 

Source: Stackoverflow read only index elasticsearch