# Full space /var/lib/elasticsearch

**URL:** <https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197>\
**Category:** Elasticsearch\
**Created:** [September 26, 2022, 5:51pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197 "2022-09-26T17:51:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Diego\_Santos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_santos/32/100222_2.png) [@Diego\_Santos](https://discuss.elastic.co/u/Diego_Santos)\
**Post date:** [September 26, 2022, 5:51pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197/1 "2022-09-26T17:51:09Z")

</div>

Hi everyone,

I have my /var/lib/elasticsearch filesystem reached 100%.

Could you please tell me what I can do?

```auto
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open .siem-signals-default-000001 dBsZlWkiTs-4JLRHOUQBaQ 1 1 0 0 226b 226b
yellow open .siem-signals-default-000002 XSqJ1_wrQUWzgo93lp07vw 1 1 0 0 226b 226b
green open .transform-internal-007 2jOM6Z7dQJ6Gz-X6heK38Q 1 0 6 0 54.5kb 54.5kb
green open .fleet-enrollment-api-keys-7 Uwip_3l7QOOu9b_nGpqvQg 1 0 2 0 11.7kb 11.7kb
yellow open .lists-default-000001 XaLrXzeQQg29T17ENL1-Xw 1 1 0 0 226b 226b
green open .apm-agent-configuration rnsrAKpASAOU3SYjxKUTMA 1 0 0 0 226b 226b
green open .kibana_task_manager_7.17.5_001 JvafCLIhTX-fzweD4CXAAg 1 0 46 96915 11.9mb 11.9mb
yellow open .items-default-000001 0_FO1gRyRs-2_F7ue_AkVg 1 1 0 0 226b 226b
green open .tasks bOz3HYF2ROC52uT_GR6w_Q 1 0 2 0 13.8kb 13.8kb
green open metrics-endpoint.metadata_current_default 0_4sC2YIRiy3GZYHipoGlg 1 0 0 0 226b 226b
green open .geoip_databases A4X0bmRrTLys71dGKDxIkg 1 0 41 41 39mb 39mb
yellow open filebeat-7.17.5-2022.09.10-000002 DY6W552fTS-5_esIDNbZgg 1 1 31704355 0 18.8gb 18.8gb
green open .kibana_7.17.5_001 ZAGd1CzUQEu9VLkQ2h91tA 1 0 8284 61325 34.1mb 34.1mb
green open .security-7 LSXIEYgIQcmcO9dnTbRPYQ 1 0 92 3 273.5kb 273.5kb
yellow open filebeat-7.17.5-2022.08.11-000001 8ZMrLnx2RbKJEdEFSKCqOw 1 1 18245082 0 6.5gb 6.5gb
green open .apm-custom-link ws2X_UCeRcmHr6_2OvutdQ 1 0 0 0 226b 226b
green open .async-search TKVqy9USRWSzidUP440SGQ 1 0 0 0 6.8kb 6.8kb
green open .fleet-policies-7 d2sc5_7URVmZ90VoDtx9tw 1 0 3 0 20.7kb 20.7kb
green open .metrics-endpoint.metadata_united_default N3hjBGvgThSxp7aOJE_DiQ 1 0 0 0 226b 226b

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 26, 2022, 6:30pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197/2 "2022-09-26T18:30:38Z")

</div>

Hi @Diego_Santos Welcome to the comunity!

Well you have 2 big indices... you will probably need to clean / delete one ...Or clean up something else on the disk ..... or expand your disk.

### TO BE CLEAR If you delete the index and you do not have a snapshot index it is gone forever

If you choose to delete one if the Indices like the older filebeat index

`filebeat-7.17.5-2022.08.11-000001`

You can log into Kibana -\> Stack Management -\> Index Management and select and delete the index.

Otherwise you can do it through curl see here [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html)

`curl -X DELETE "localhost:9200/filebeat-7.17.5-2022.08.11-000001?pretty"`

---

<div class="post-metadata">

**Author:** ![Diego\_Santos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/diego_santos/32/100222_2.png) [@Diego\_Santos](https://discuss.elastic.co/u/Diego_Santos)\
**Post date:** [September 26, 2022, 8:43pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197/3 "2022-09-26T20:43:51Z")

</div>

Thanks @stephenb!

Could you please let me know if there is a way to create a routine so it doesn't grow so much?

Thank you very much

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 26, 2022, 10:13pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197/4 "2022-09-26T22:13:08Z")

</div>

Its Called Index Lifecycle Management Pretty big topic... see [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html)

But in Short You can just go to

Kibana -\> Stack Management -\> Index Lifecycle Management

Find the one should be named `filebeat-7.17.5`

And Adjust Set the Rollover, set delete after

 ![Screen Shot 2022-09-26 at 3.10.18 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/8/9898eafb4fa542e5f972812d66416261013eae3b.png)

And then set when you want to delete..

 ![Screen Shot 2022-09-26 at 3.08.33 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/6/86eff67ef4a649314475cad1ab3372e0a1353fd3.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2022, 10:14pm UTC](https://discuss.elastic.co/t/full-space-var-lib-elasticsearch/315197/5 "2022-10-24T22:14:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.