How to manage multitenant ELK Cluster

[verdienansein]

Hi,
in our project we are using a multitenant cluster where several applications are logging to it with weekly log indices.
We are facing now a problem because some of these applications are creating very big indices of logs saturating our disk space. We cannot increase our disk storage because it is a fixed size.
Is there any possibility to create "quotas" in order to limit in some way the quantity of logs each application can create? There is any solution or alternative that Elasticsearch can provide in this kind of situation?
Thanks

[warkolm (Mark Walkom)]

Welcome to our community!

@verdienansein

Is there any possibility to create "quotas" in order to limit in some way the quantity of logs each application can create?

Not natively, no.

@verdienansein

There is any solution or alternative that Elasticsearch can provide in this kind of situation?

You can look to split indices by user, then use [ILM]ILM: Manage the index lifecycle | Elasticsearch Guide [8.11] | Elastic) to manage retention.