# Local Storage Full

**URL:** https://discuss.elastic.co/t/local-storage-full/296078
**Category:** Elasticsearch
**Created:** [February 2, 2022, 3:27pm UTC](https://discuss.elastic.co/t/local-storage-full/296078 "2022-02-02T15:27:33Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![eprop-marc](https://avatars.discourse-cdn.com/v4/letter/e/d2c977/32.png) [@eprop-marc](https://discuss.elastic.co/u/eprop-marc)
#### Post date: [February 2, 2022, 3:27pm UTC](https://discuss.elastic.co/t/local-storage-full/296078/1 "2022-02-02T15:27:33Z")

</div>

Hi, the local storage on my ELK stack is 95% full and I can no longer see logs in Elastic. I just wanted some advice on how best to reduce the storage on the local disk please and start using Elastic again. I don't really want to add more storage to my EC2 instance as because in about a month I will have the same problem again.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 2, 2022, 8:41pm UTC](https://discuss.elastic.co/t/local-storage-full/296078/2 "2022-02-02T20:41:34Z")

</div>

Are you deleting older indices? That'd be where I'd start.

---

<div class="post-metadata">

### Author: ![eprop-marc](https://avatars.discourse-cdn.com/v4/letter/e/d2c977/32.png) [@eprop-marc](https://discuss.elastic.co/u/eprop-marc)
#### Post date: [February 2, 2022, 11:34pm UTC](https://discuss.elastic.co/t/local-storage-full/296078/3 "2022-02-02T23:34:06Z")

</div>

Im not no, Im new to ELK and Elastic, so not sure how to delete the older indices? If I did delete the older indices, would that affect the searching of older logs?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 2, 2022, 11:49pm UTC](https://discuss.elastic.co/t/local-storage-full/296078/4 "2022-02-02T23:49:49Z")

</div>

> [@eprop-marc](#):
>
> If I did delete the older indices, would that affect the searching of older logs?

Yes because they won't exist in Elasticsearch.  
But unless you can add more disk space to the host, that's the only real alternative.

[Delete index API | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html) goes into it

---

<div class="post-metadata">

### Author: ![eprop-marc](https://avatars.discourse-cdn.com/v4/letter/e/d2c977/32.png) [@eprop-marc](https://discuss.elastic.co/u/eprop-marc)
#### Post date: [February 3, 2022, 12:01am UTC](https://discuss.elastic.co/t/local-storage-full/296078/5 "2022-02-03T00:01:56Z")

</div>

Ok thanks for the document. If I do add more disk, in a month or so it will just fill up again, can I enable something like logrotate?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 3, 2022, 12:02am UTC](https://discuss.elastic.co/t/local-storage-full/296078/6 "2022-02-03T00:02:46Z")

</div>

You probably want to look at implementing [ILM](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html) to manage that for you.

---

<div class="post-metadata">

### Author: ![eprop-marc](https://avatars.discourse-cdn.com/v4/letter/e/d2c977/32.png) [@eprop-marc](https://discuss.elastic.co/u/eprop-marc)
#### Post date: [February 4, 2022, 11:43am UTC](https://discuss.elastic.co/t/local-storage-full/296078/7 "2022-02-04T11:43:18Z")

</div>

Thanks. I have created the ILM, not sure how to apply it? I have logstash and filebeat. All of my logs come in from AWS EFS drives.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 4, 2022, 11:43am UTC](https://discuss.elastic.co/t/local-storage-full/296078/8 "2022-03-04T11:43:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
