ELK suddenly colapsed

You can also can close unused indexes (their data become unavailable, but it would free up the memory)

Run curl -XGET "localhost:9200/_stats?pretty" and get a look at all - segments - memory_in_bytes. Divide memory_in_bytes by number of nodes and you'll get rough estimation of memory consumption on each node.

For more details, please, follow these links: topic1, topic2