# Cluster Logs Filling Drive

**URL:** <https://discuss.elastic.co/t/cluster-logs-filling-drive/50573>\
**Category:** Elasticsearch\
**Created:** [May 20, 2016, 2:59pm UTC](https://discuss.elastic.co/t/cluster-logs-filling-drive/50573 "2016-05-20T14:59:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [May 20, 2016, 2:59pm UTC](https://discuss.elastic.co/t/cluster-logs-filling-drive/50573/1 "2016-05-20T14:59:57Z")

</div>

I have a 50G root partition and the Elasticsearch cluster log files have consumed the whole drive on two of my 3 nodes. The files are located in `/var/log/elasticsearch`. Whats the best way of keeping these files under control and from filling up the drive?

---

<div class="post-metadata">

**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\
**Post date:** [May 20, 2016, 6:53pm UTC](https://discuss.elastic.co/t/cluster-logs-filling-drive/50573/2 "2016-05-20T18:53:47Z")

</div>

Typically, Elasticsearch is not very chatty when it comes to the log messages with default log settings. So, if you didn't change the log settings, these 50G of log messages might indicate that something really wrong is going on in the cluster. What kind of errors do you see in the log files?

---

<div class="post-metadata">

**Author:** ![jnpetty](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@jnpetty](https://discuss.elastic.co/u/jnpetty)\
**Post date:** [May 20, 2016, 7:12pm UTC](https://discuss.elastic.co/t/cluster-logs-filling-drive/50573/3 "2016-05-20T19:12:41Z")

</div>

I went back and it looks like most of these logs were created while we were having issues with one of the nodes in the cluster. I ended up deleting all of the logs on each of the servers. Will continue to monitor from here on out. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:50pm UTC](https://discuss.elastic.co/t/cluster-logs-filling-drive/50573/4 "2017-07-05T22:50:04Z")

</div>


