Auditbeat: Index file grows rapidly causing No space left issue

I have noticed that auditbeat index grows very rapidly in Linux using high disk space. It grows to around 500 MB. This fills up the disk space causing 'No space left on device' error.

Has someone experienced a similar issue and been able to fix it and how?

Are you referring to Elasticsearch indices?

It is not elasticsearch index but more so the Auditbeat index file that grows exponentially. I believe that the Auditbeat index collects data for several activities which then fills up the index. I have to then delete the index to fix the space issue.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.