Full space /var/lib/elasticsearch

[Diego_Santos]

Hi everyone,

I have my /var/lib/elasticsearch filesystem reached 100%.

Could you please tell me what I can do?

health status index                                     uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   .siem-signals-default-000001              dBsZlWkiTs-4JLRHOUQBaQ   1   1          0            0       226b           226b
yellow open   .siem-signals-default-000002              XSqJ1_wrQUWzgo93lp07vw   1   1          0            0       226b           226b
green  open   .transform-internal-007                   2jOM6Z7dQJ6Gz-X6heK38Q   1   0          6            0     54.5kb         54.5kb
green  open   .fleet-enrollment-api-keys-7              Uwip_3l7QOOu9b_nGpqvQg   1   0          2            0     11.7kb         11.7kb
yellow open   .lists-default-000001                     XaLrXzeQQg29T17ENL1-Xw   1   1          0            0       226b           226b
green  open   .apm-agent-configuration                  rnsrAKpASAOU3SYjxKUTMA   1   0          0            0       226b           226b
green  open   .kibana_task_manager_7.17.5_001           JvafCLIhTX-fzweD4CXAAg   1   0         46        96915     11.9mb         11.9mb
yellow open   .items-default-000001                     0_FO1gRyRs-2_F7ue_AkVg   1   1          0            0       226b           226b
green  open   .tasks                                    bOz3HYF2ROC52uT_GR6w_Q   1   0          2            0     13.8kb         13.8kb
green  open   metrics-endpoint.metadata_current_default 0_4sC2YIRiy3GZYHipoGlg   1   0          0            0       226b           226b
green  open   .geoip_databases                          A4X0bmRrTLys71dGKDxIkg   1   0         41           41       39mb           39mb
yellow open   filebeat-7.17.5-2022.09.10-000002         DY6W552fTS-5_esIDNbZgg   1   1   31704355            0     18.8gb         18.8gb
green  open   .kibana_7.17.5_001                        ZAGd1CzUQEu9VLkQ2h91tA   1   0       8284        61325     34.1mb         34.1mb
green  open   .security-7                               LSXIEYgIQcmcO9dnTbRPYQ   1   0         92            3    273.5kb        273.5kb
yellow open   filebeat-7.17.5-2022.08.11-000001         8ZMrLnx2RbKJEdEFSKCqOw   1   1   18245082            0      6.5gb          6.5gb
green  open   .apm-custom-link                          ws2X_UCeRcmHr6_2OvutdQ   1   0          0            0       226b           226b
green  open   .async-search                             TKVqy9USRWSzidUP440SGQ   1   0          0            0      6.8kb          6.8kb
green  open   .fleet-policies-7                         d2sc5_7URVmZ90VoDtx9tw   1   0          3            0     20.7kb         20.7kb
green  open   .metrics-endpoint.metadata_united_default N3hjBGvgThSxp7aOJE_DiQ   1   0          0            0       226b           226b

[stephenb (Stephen Brown)]

Hi @Diego_Santos Welcome to the comunity!

Well you have 2 big indices... you will probably need to clean / delete one ...Or clean up something else on the disk ..... or expand your disk.

TO BE CLEAR If you delete the index and you do not have a snapshot index it is gone forever

If you choose to delete one if the Indices like the older filebeat index

filebeat-7.17.5-2022.08.11-000001

You can log into Kibana -> Stack Management -> Index Management and select and delete the index.

Otherwise you can do it through curl see here https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html

curl -X DELETE "localhost:9200/filebeat-7.17.5-2022.08.11-000001?pretty"

[Diego_Santos]

Thanks @stephenb!

Could you please let me know if there is a way to create a routine so it doesn't grow so much?

Thank you very much

[stephenb (Stephen Brown)]

Its Called Index Lifecycle Management Pretty big topic... see here

But in Short You can just go to

Kibana -> Stack Management -> Index Lifecycle Management

Find the one should be named filebeat-7.17.5

And Adjust Set the Rollover, set delete after

And then set when you want to delete..