# Elastic cloud kills itself with logs

**URL:** <https://discuss.elastic.co/t/elastic-cloud-kills-itself-with-logs/360453>\
**Category:** Elastic Cloud Enterprise (ECE)\
**Created:** [May 29, 2024, 11:11am UTC](https://discuss.elastic.co/t/elastic-cloud-kills-itself-with-logs/360453 "2024-05-29T11:11:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DanHampl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danhampl/32/131799_2.png) [@DanHampl](https://discuss.elastic.co/u/DanHampl)\
**Post date:** [May 29, 2024, 11:11am UTC](https://discuss.elastic.co/t/elastic-cloud-kills-itself-with-logs/360453/1 "2024-05-29T11:11:07Z")

</div>

Hi, idk where to post a bug for elastic to fix, so im trying here.

When you pick the smallest CPU optimized instance, it sets logs index lifecycle with 50 GB storage limit, and says its managed index, and if you change it you might break kibana.

The issue here is that the smallest instance has 35GB storage, and dies once you fill it with the logs. You might want to fix that.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 30, 2024, 4:00am UTC](https://discuss.elastic.co/t/elastic-cloud-kills-itself-with-logs/360453/2 "2024-05-30T04:00:15Z")

</div>

Hi @DanHampl Welcome to the community and thanks for trying Elastic Cloud...

Yup that can happen but Not a bug / By Design... there is a long history to the 50GB shard / ILM policies etc. The defaults are designed logs ingestion the with a medium scale and and cluster size that fits more common use cases with "sensible" defaults.

Also Default ILM Policy has unlimited retention (i.e. it does not delete any data), it is up to the user to apply their own ILM policy etc... so if the user never apply ILM changes / Own ILM policies the cluster will eventually fill up.

Logs with default ILM not is intended for 1GB sized Nodes

You can change the Managed ILM policy it won't hurt anything... Even with smaller shard size you will still run out of room since the default ILM does not delete..

---

<div class="post-metadata">

**Author:** ![DanHampl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danhampl/32/131799_2.png) [@DanHampl](https://discuss.elastic.co/u/DanHampl)\
**Post date:** [May 30, 2024, 11:02am UTC](https://discuss.elastic.co/t/elastic-cloud-kills-itself-with-logs/360453/3 "2024-05-30T11:02:11Z")

</div>

To me, that sounds like a bad design. Having something marked as "do not touch or you might break your environment" and without touching it having it actually break the environment...

Thanks for the recommendations though. already set those up and it all seems to be working.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 30, 2024, 1:20pm UTC](https://discuss.elastic.co/t/elastic-cloud-kills-itself-with-logs/360453/4 "2024-05-30T13:20:32Z")

</div>

Yup.. bad design on the message. Agree.

You are welcome to open an issue against the elasticsearch repo.

As a side note, people have been filling up their elasticsearch disks since the first day it was released. 🙂
