# Can't log in anymore after disk full

**URL:** <https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888>\
**Category:** Elasticsearch\
**Created:** [March 1, 2017, 12:27am UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888 "2017-03-01T00:27:32Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![tonychong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonychong/32/15126_2.png) [@tonychong](https://discuss.elastic.co/u/tonychong)\
**Post date:** [March 1, 2017, 12:27am UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/1 "2017-03-01T00:27:32Z")

</div>

Hi,

Running ES 5.2.0 with Kibana 5.2.0 and Logstash 5.2.0 and X-PACK as well. I'm on a trial and I'm testing out all the new features but I have let my indices grow out of control and the data nodes have no free space. A unique detail about my setup is that I have everything setup in Kubernetes so the directory used is writing to an emptyDir, meaning if I restart the data node container the data will be gone.

I think this has caused me to be unable to log into the ES cluster. I can still log into kibana though. Is there something I can do without having to reinstall everything? This isn't production data or anything critical so I don't mind rebuilding, but it's just a hassle.

Thanks!

Tony

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 1, 2017, 12:38am UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/2 "2017-03-01T00:38:00Z")

</div>

Just delete the indices via the ES APIs and you should be good.

---

<div class="post-metadata">

**Author:** ![tonychong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonychong/32/15126_2.png) [@tonychong](https://discuss.elastic.co/u/tonychong)\
**Post date:** [March 1, 2017, 12:38am UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/3 "2017-03-01T00:38:50Z")

</div>

The problem is I can't because I'm not authorized to do so, because the credentials dont' work.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 1, 2017, 1:12am UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/4 "2017-03-01T01:12:11Z")

</div>

Can you provide more details about the error you get when trying to login.

- What user are you using?
- Which realm is that user authenticated against (native, file, LDAP, etc)
- What output do you get when you run this? (you might need to change the URL or username to match your environment)

```auto
       curl -u elastic 'http://localhost:9200/?error_trace=true'

```

---

<div class="post-metadata">

**Author:** ![tonychong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonychong/32/15126_2.png) [@tonychong](https://discuss.elastic.co/u/tonychong)\
**Post date:** [March 1, 2017, 1:28am UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/5 "2017-03-01T01:28:28Z")

</div>

Sure.

- What user are you using?  
`elastic`
- Which realm is that user authenticated against (native, file, LDAP, etc)  
Native? I'm not sure, but I think it is.

`{"error":{"root_cause":[{"type":"security_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"failed to authenticate user [elastic]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}`

- What output do you get when you run this? (you might need to change the URL or username to match your environment)  
I get this:  
`Enter host password for user 'elastic':`

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 1, 2017, 2:49am UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/6 "2017-03-01T02:49:37Z")

</div>

> `Enter host password for user 'elastic':`

And what output do you get after you enter the password?

---

<div class="post-metadata">

**Author:** ![tonychong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tonychong/32/15126_2.png) [@tonychong](https://discuss.elastic.co/u/tonychong)\
**Post date:** [March 3, 2017, 6:50pm UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/7 "2017-03-03T18:50:06Z")

</div>

I ended up re-provisioning my cluster. In all honesty, this was way to difficult to troubleshoot so I'm trying out the cloud solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2017, 6:50pm UTC](https://discuss.elastic.co/t/cant-log-in-anymore-after-disk-full/76888/8 "2017-03-31T18:50:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
