# Error in Logstash log . "Error: Disc quota exceeded"

**URL:** <https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102>\
**Category:** Logstash\
**Created:** [July 21, 2017, 11:15am UTC](https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102 "2017-07-21T11:15:07Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sreepatch](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@sreepatch](https://discuss.elastic.co/u/sreepatch)\
**Post date:** [July 21, 2017, 11:15am UTC](https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102/1 "2017-07-21T11:15:08Z")

</div>

i am getting Error: Disc quota exceeded", :level=\>:error in the logstash log. why this occurs and how can it be resolved?

Logstash is being used to Push the data to ELastic Search. In the OuptFilter of Logstash we have mentioned host name and index name

---

<div class="post-metadata">

**Author:** ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)\
**Post date:** [July 24, 2017, 9:17am UTC](https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102/2 "2017-07-24T09:17:17Z")

</div>

Is your disk full ?  
Logstash need a little bit space to save status and queues ...

pts0

---

<div class="post-metadata">

**Author:** ![sreepatch](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@sreepatch](https://discuss.elastic.co/u/sreepatch)\
**Post date:** [July 24, 2017, 9:47am UTC](https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102/3 "2017-07-24T09:47:28Z")

</div>

We have disk space of around 40GB avaialble. And provided below how the error looks from the logstash log:  
{:timestamp=\>"2017-07-24T05:41:07.568000-0400", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::File type=\>"Sample",  
path=\>["/mySampleDir/log/\*"], codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, stat\_interval=\>1, discover\_interval=\>15, sincedb\_write\_inter  
val=\>15, start\_position=\>"end", delimiter=\>"\n"\>\n Error: Disc quota exceeded", :level=\>:error}

How much min/max space Logstash needs for its usage?  
Do we need to specify the max size of log entries in Logstash configuration file?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![pts0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pts0/32/17811_2.png) [@pts0](https://discuss.elastic.co/u/pts0)\
**Post date:** [July 24, 2017, 11:38am UTC](https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102/4 "2017-07-24T11:38:12Z")

</div>

Hmm,

40GB should be ok, are u sure is quota for the user set, maybe you have space but you run out of quota.  
How much space for logstash, I have no idea. For the since files (store where the file pointer are keep) some kilobytes. For the queue is depending of how big are your data and how good or bad is connection to elastic.  
Can you try to start with another user or root ?

Maybe you post you config ...

thanks  
pts0

---

<div class="post-metadata">

**Author:** ![sreepatch](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@sreepatch](https://discuss.elastic.co/u/sreepatch)\
**Post date:** [July 27, 2017, 6:55am UTC](https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102/5 "2017-07-27T06:55:37Z")

</div>

> [@sreepatch](#):
>
> /mySampleDir/log/\*

Hi,  
As you said i have started with another user but still faces the same issue . Below is my logstash config

input {  
file {  
type =\> "Audit\_1"  
path =\> "/mySampleDir/log/\*"

```
	}
 file
    {
        type => "Audit_2"
        path => "/mySampleDir2/log/*"
       
    }

```

}  
filter {  
if [type] == "Audit\_1"  
{  
grok {  
pattern =\> "%{GREEDYDATA:DATE}|%{GREEDYDATA:GATEWAY}|%{GREEDYDATA:APPLICATION}|%{GREEDYDATA:REQUEST}|%{GREEDYDATA:TRACE\_ID}|%{GREEDYDATA:UNIQUE\_ID}|%{GREEDYDATA:RECEIVE\_TIME}|"

add\_field =\> {  
"recvTime" =\> "%{DATE} %{RECEIVE\_TIME}"  
}  
}  
}

```
 if [type] == "Audit_2" 
{

```

grok {  
pattern =\> "%{GREEDYDATA:DATE}|%{GREEDYDATA:REQUEST}|%{GREEDYDATA:TRACE\_ID}|%{GREEDYDATA:UNIQUE\_ID}|%{GREEDYDATA:ACCT\_ID}|%{GREEDYDATA:RECEIVE\_TIME}|"

add\_field =\> {  
"recvTime" =\> "%{DATE} %{RECEIVE\_TIME}"  
}  
}  
}

date{  
match =\> ["recvTime" , "MMddyy HH:mm:ss.SSS"]  
target =\> "my\_recv\_time"  
}

}  
output  
{  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "my\_audit\_logs"  
}

}

The error is as below:  
{:timestamp=\>"2017-07-27T02:45:44.407000-0400", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::File type=\>"Audit\_2",  
path=\>["/mySampleDir2/log/\*"], codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, stat\_interval=\>1, discover\_interval=\>15, sincedb\_write\_inter  
val=\>15, start\_position=\>"end", delimiter=\>"\n"\>\n Error: Disc quota exceeded", :level=\>:error}

Please help as i am clue less and did not find any source for this error over the internet,

Thanks in Advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2017, 6:56am UTC](https://discuss.elastic.co/t/error-in-logstash-log-error-disc-quota-exceeded/94102/6 "2017-08-24T06:56:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.