Q: 通过 docker-compose 运行的 graylog 及 elasticsearch，如何进入 elasticsearch？
A:
sudo docker-compose exec elasticsearch bash
Q: How to fix ElasticSearch [FORBIDDEN/12/index read-only / allow delete (api)]
elasticsearch.exceptions.AuthorizationException: AuthorizationException(403, 'cluster_block_exception', 'blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];')
A: run below script
curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'
ref: https://stackoverflow.com/questions/50609417/elasticsearch-error-cluster-block-exception-forbidden-12-index-read-only-all
Q：graylog_deflector 有 Unassigned Shards，而且 graylog 无法正常工作
A:
curl -X DELETE 'http://127.0.0.1:9200/graylog_deflector'
Q: 删除旧的日志，释放硬盘空间
A: login graylog，System -> Indices，在 Index Rotation Configuration 中设置