Auditbeat: Index file grows rapidly causing No space left issue

[Stud21 (PatD)]

I have noticed that auditbeat index grows very rapidly in Linux using high disk space. It grows to around 500 MB. This fills up the disk space causing 'No space left on device' error.

Has someone experienced a similar issue and been able to fix it and how?

[mtojek (Marcin Tojek)]

Are you referring to Elasticsearch indices?

How to limit the size of the index?

Hi all, I have install recently my logstash/elasticsearch solution. But I have a size problem too many log after 1 month the index size too important. I want to know if exist a solution to delete automaticaly the old events or to limit the size oh the index ? Thanks -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.…

Index Max Size

Hello Guys , Sorry for my noob question, but I can't find where can I setup the index size?. I just see in docs about shard cache or buffer size. Thank you

Is it possible to limit a size of an Elasticsearch index?

[Stud21 (PatD)]

It is not elasticsearch index but more so the Auditbeat index file that grows exponentially. I believe that the Auditbeat index collects data for several activities which then fills up the index. I have to then delete the index to fix the space issue.