# Auditbeat: Index file grows rapidly causing No space left issue

**URL:** <https://discuss.elastic.co/t/auditbeat-index-file-grows-rapidly-causing-no-space-left-issue/280492>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [August 5, 2021, 4:12am UTC](https://discuss.elastic.co/t/auditbeat-index-file-grows-rapidly-causing-no-space-left-issue/280492 "2021-08-05T04:12:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stud21](https://avatars.discourse-cdn.com/v4/letter/s/dfb087/32.png) [@Stud21](https://discuss.elastic.co/u/Stud21)\
**Post date:** [August 5, 2021, 4:12am UTC](https://discuss.elastic.co/t/auditbeat-index-file-grows-rapidly-causing-no-space-left-issue/280492/1 "2021-08-05T04:12:12Z")

</div>

I have noticed that auditbeat index grows very rapidly in Linux using high disk space. It grows to around 500 MB. This fills up the disk space causing 'No space left on device' error.

Has someone experienced a similar issue and been able to fix it and how?

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [August 5, 2021, 8:09am UTC](https://discuss.elastic.co/t/auditbeat-index-file-grows-rapidly-causing-no-space-left-issue/280492/2 "2021-08-05T08:09:05Z")

</div>

Are you referring to Elasticsearch indices?

> [@How to limit the size of the index?](https://discuss.elastic.co/t/how-to-limit-the-size-of-the-index/12638):
>
> Hi all, I have install recently my logstash/elasticsearch solution. But I have a size problem too many log after 1 month the index size too important. I want to know if exist a solution to delete automaticaly the old events or to limit the size oh the index ? Thanks -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).…

> [@Index Max Size](https://discuss.elastic.co/t/index-max-size/42421):
>
> Hello Guys , Sorry for my noob question, but I can't find where can I setup the index size?. I just see in docs about shard cache or buffer size. Thank you

> <https://stackoverflow.com/questions/32635456/is-it-possible-to-limit-a-size-of-an-elasticsearch-index>

---

<div class="post-metadata">

**Author:** ![Stud21](https://avatars.discourse-cdn.com/v4/letter/s/dfb087/32.png) [@Stud21](https://discuss.elastic.co/u/Stud21)\
**Post date:** [August 10, 2021, 5:08am UTC](https://discuss.elastic.co/t/auditbeat-index-file-grows-rapidly-causing-no-space-left-issue/280492/3 "2021-08-10T05:08:07Z")

</div>

It is not elasticsearch index but more so the Auditbeat index file that grows exponentially. I believe that the Auditbeat index collects data for several activities which then fills up the index. I have to then delete the index to fix the space issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2021, 7:08am UTC](https://discuss.elastic.co/t/auditbeat-index-file-grows-rapidly-causing-no-space-left-issue/280492/4 "2021-09-07T07:08:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.