# How to extend /var file partition **URL:** \ **Category:** Elasticsearch\ **Created:** [January 2, 2023, 11:34am UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305 "2023-01-02T11:34:58Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Kosala\_Randika\_Paran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosala_randika_paran/32/112225_2.png) [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Post date:** [January 2, 2023, 11:34am UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/1 "2023-01-02T11:34:59Z")
![Screenshot 2023-01-02 170223](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a516c5d3390dbf04dbed8ba27386a7351620adc.jpeg) The /dev/mapper/centos-var partition got full Can anyone suggest a solution for extending it or any solution? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 2, 2023, 1:06pm UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/2 "2023-01-02T13:06:03Z")
> [@Kosala\_Randika\_Paran](#): > > The /dev/mapper/centos-var partition got full Can anyone suggest a solution for extending it or any solution? This question is out of the scope of this forum, it is not related to Elasticsearch, you need to check with your system admins to solve this issue. ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [January 2, 2023, 5:11pm UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/3 "2023-01-02T17:11:50Z")
Unless it's all Elasticsearch logs? But I'd highly doubt that 😅 ---
**Author:** ![Kosala\_Randika\_Paran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosala_randika_paran/32/112225_2.png) [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Post date:** [January 3, 2023, 6:31am UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/4 "2023-01-03T06:31:33Z")
We can not start our Elasticsearch service when starting it given this message, so may I know is there any ELK logs saving so that if I cleared this we will lose history logs? ![Screenshot 2023-01-03 115340](https://us1.discourse-cdn.com/elastic/original/3X/6/8/686f048d83fe93b397e44e38295a1e1fb7c54bdd.jpeg) ---
**Author:** ![Kosala\_Randika\_Paran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosala_randika_paran/32/112225_2.png) [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Post date:** [January 3, 2023, 8:05am UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/5 "2023-01-03T08:05:03Z")
Hi floks, I could narrow down some point as follows, so seem like it filled data with elasticsearch indices (almost 1.6 TB), so we have 3 elasticsearch nodes in our cluster, any step to resolve this issue? ![Screenshot 2023-01-03 131336-ELK01](https://us1.discourse-cdn.com/elastic/original/3X/9/8/98d4a44e7710bf3e2070805c6a075c983064bd2d.jpeg) ![Screenshot 2023-01-03 131336-ELK02](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b4349db8c93d67d428e37dbb752460bbea124e60.jpeg) ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 3, 2023, 11:01am UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/6 "2023-01-03T11:01:41Z")
From pics, your disk partion is 1.8 TB, and ES has used 1.6 TB for indices, logs are 2.4 GB. Even if you clean logs, will not help. You have to extend your partition, as ECEngineers said, it's not in their domain. This is the best option, however make plan for future, for instance extension for 1 TB is a temporary solution. Be careful with extending. Would not recommend to manually remove any of indices. To run safely ES, you must have enough disk space. `cluster.routing.allocation.disk.watermark.low: (Default 85%)` `cluster.routing.allocation.disk.watermark.high: (Default 90%)` `cluster.routing.allocation.disk.watermark.flood_stage: (Default 95%)` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [January 3, 2023, 11:29am UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/7 "2023-01-03T11:29:58Z")
Might be a useful command, check which is the biggest index: `du -h /var/lib/elasticsearch/indices | sort -rh | head -20` From Devtools/ curl: ```auto GET /_cat/indices?v&s=store.size:desc curl -u user:pass "localhost:9200/_cat/indices?v&s=store.size:desc" ``` The uuid column is the directory name in: /var/lib/elasticsearch/indices/ ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [January 3, 2023, 2:57pm UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/8 "2023-01-03T14:57:36Z")
Though I'm a bit surprised how you ended up there? Did you change the (floodstage) watermark or did another process fill the rest of the disk? The default settings should avoid that situation. Safest option would be to enlarge the disk. If you are sure you have a replica of all the data (or don't really need what's on that node anyway), you could delete the (Elasticsearch) node. Deleting individual files from the data directory is IMO only a last effort hack that I'd avoid unless you have no other options left. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 31, 2023, 2:58pm UTC](https://discuss.elastic.co/t/how-to-extend-var-file-partition/322305/9 "2023-01-31T14:58:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.