Moving indices from Hot tier to Cold does not reduce hot tier size

Oolong · January 9, 2025, 1:37pm

Hi Everyone,

I have 200GB storage for HOT tier and 500GB for cold. I have so far used up 150GB on the HOT tier and have moved the indices that make up that 150 to Cold tier. My problem is that the Cold tier has increased by 150GB but Hot tier didn't go down in size.

Please advise on what I could be doing wrong. I want to keep logs for a year and not delete anything but I don't want to keep logs in the HOT tier. For now I would like to move data manually and will use ILM policies later when I understand them better.

I am currently using the elasticsearch cloud version 8.17.

Christian_Dahlqvist · January 10, 2025, 7:57am

How many nodes do you have in the cluster? How are these configured?

How did you do this? What are the settings of your indices?

I would recommend reading up on and implementing this as soon as possible.

Oolong · January 10, 2025, 3:23pm

Hi @Christian_Dahlqvist, Thank you for your reply.

I have 3 nodes. Everything is default (I followed the getting started wizard, Rookie Here).

I used the following command to move it.

PUT .ds-logs-fortinet_fortigate.log-default-2024.12.21-000010/_settings
{
  "index": {
    "routing": {
      "allocation": {
        "include": {
          "_tier_preference": "data_cold"
        }
      }
    }
  }
}

And this is the indices settings :

{
  ".ds-logs-fortinet_fortigate.log-default-2024.12.21-000010": {
    "settings": {
      "index": {
        "mapping": {
          "total_fields": {
            "limit": "10000",
            "ignore_dynamic_beyond_limit": "true"
          },
          "ignore_malformed": "true"
        },
        "hidden": "true",
        "provided_name": ".ds-logs-fortinet_fortigate.log-default-2024.12.21-000010",
        "final_pipeline": ".fleet_final_pipeline-1",
        "creation_date": "1734741312934",
        "number_of_replicas": "1",
        "uuid": "_eSbpNBkRImoQd67asqPDg",
        "version": {
          "created": "8512000"
        },
        "lifecycle": {
          "name": "logs",
          "indexing_complete": "true"
        },
        "mode": "standard",
        "codec": "best_compression",
        "routing": {
          "allocation": {
            "include": {
              "_tier_preference": "data_cold"
            }
          }
        },
        "number_of_shards": "1",
        "default_pipeline": "logs-fortinet_fortigate.log-1.25.8"
      }
    }
  }
}

I was expecting that when I see the indice being in the cold tier it will release the storage it was using in the Hot tier. Support asked me to restard the node but this hasn't helped.

Christian_Dahlqvist · January 10, 2025, 3:32pm

Do you have 2 hot nodes and 1 cold node? Do you have replicas configured for the indices you are moving?

Oolong · January 10, 2025, 4:03pm

I can't see the roles through :

GET /_cat/nodes?v&h=name,ip,roles

I think there is replicas setup.

leandrojmp · January 10, 2025, 4:04pm

You are already using an ILM policy as your data is from an Elastic Agent integration.

It is managed by the default logs policy, which will not move between data tiers.

What is the result of running GET _cat/shards?v in Kibana Dev Tools and looking for the index you manually moved ? In which node it is?

Oolong · January 10, 2025, 4:29pm

Thank you, when i understand ILM policies better i will duplicate this and use it instead of doing it manually.

When running GET _cat/shards?v and filtering by the indice in question I get the following :

.ds-logs-fortinet_fortigate.log-default-2024.12.21-000010                                                                       0     p      STARTED    127041600     50gb     50gb X.X.X.X instance-0000000003
.ds-logs-fortinet_fortigate.log-default-2024.12.21-000010                                                                       0     r      UNASSIGNED

Christian_Dahlqvist · January 10, 2025, 4:34pm

As you only have one cold node I suspect you will need to set the number of replicas to 0 for indices relocated there. Try this and see if that changes anything.

Oolong · January 10, 2025, 4:35pm

Thanks christian let me try this now.

leandrojmp · January 10, 2025, 5:35pm

Is this instance a hot or cold node?

Please share the result of running GET /_cat/nodes?v&h=name,role&s=name so it is more clear how your cluster is configured.

Oolong · January 10, 2025, 5:36pm

This is the results

name                role
instance-0000000003 cr
instance-0000000004 lr
instance-0000000006 himrst

leandrojmp · January 10, 2025, 5:43pm

So for data nodes you have one hot node, instance-0000000006 and one cold node, instance-0000000003.

Not sure what is exactly the issue here as the index you moved is correctly allocated into the cold node, so the index was moved from the hot to the cold node.

The fact that the space didn't change may be related to other issues.

Can you share the full result of running GET _cat/shards?v in Dev Tools? This would show all your shards and make it possible to calculate how much data you have in each node.

Oolong · January 10, 2025, 5:51pm

I will send in two parts because of size

index                                                                                                                           shard prirep state           docs    store  dataset ip           node
.security-tokens-7                                                                                                              0     p      STARTED           48  100.2kb  100.2kb 10.46.11.153 instance-0000000006
.ent-search-esqueues-me_queue_v1_engine_destroyer                                                                               0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.process.summary-default-2024.09.25-000001                                                                    0     p      STARTED        40007      2mb      2mb 10.46.11.153 instance-0000000006
.ds-metrics-system.process.summary-default-2024.09.25-000001                                                                    0     r      UNASSIGNED                                          
.ds-logs-fortinet_fortigate.log-default-2025.01.07-000015                                                                       0     p      STARTED    115110158   42.5gb   42.5gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2025.01.07-000015                                                                       0     r      UNASSIGNED                                          
.ds-metrics-fleet_server.agent_versions-default-2024.09.17-000001                                                               0     p      STARTED        69916    1.6mb    1.6mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_versions-default-2024.09.17-000001                                                               0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.endpoint_security-default-2024.09.21-000001                                                           0     p      STARTED       224703  202.9mb  202.9mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.endpoint_security-default-2024.09.21-000001                                                           0     r      UNASSIGNED                                          
.ent-search-actastic-crawler_robots_txts_v3                                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler2_robots_txts                                                                                       0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_role_mappings_v8                                                                          0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-app_search_crawler_content_metadata                                                                        0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat_input-default-2024.11.20-000003                                                              0     p      STARTED       594174  487.3mb  487.3mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat_input-default-2024.11.20-000003                                                              0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.security-default-2024.09.21-000001                                                                     0     p      STARTED      7495022    1.1gb    1.1gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.09.21-000001                                                                     0     r      UNASSIGNED                                          
.ent-search-actastic-oauth_access_tokens_v2-token-unique-constraint                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.auditbeat-default-2024.12.05-000001                                                                      0     p      STARTED       229347   42.7mb   42.7mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.auditbeat-default-2024.12.05-000001                                                                      0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.endpoint_security-default-2024.12.20-000004                                                              0     p      STARTED      1509799  117.4mb  117.4mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.endpoint_security-default-2024.12.20-000004                                                              0     r      UNASSIGNED                                          
.ds-logs-elastic_agent-default-2024.12.30-000005                                                                                0     p      STARTED         2622  675.1kb  675.1kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent-default-2024.12.30-000005                                                                                0     r      UNASSIGNED                                          
.ds-.slm-history-7-2024.10.15-000005                                                                                            0     p      STARTED          673  359.1kb  359.1kb 10.46.11.153 instance-0000000006
.kibana-observability-ai-assistant-kb-000001                                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.internal.alerts-transform.health.alerts-default-000001                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.endpoint_security-default-2024.11.20-000003                                                           0     p      STARTED       161146    170mb    170mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.endpoint_security-default-2024.11.20-000003                                                           0     r      UNASSIGNED                                          
.ent-search-actastic-crawler2_content_metadata                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-windows.powershell-default-2024.11.02-000002                                                                           0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-windows.powershell-default-2024.11.02-000002                                                                           0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.elastic_agent-default-2024.11.20-000003                                                               0     p      STARTED      1229314     65mb     65mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.elastic_agent-default-2024.11.20-000003                                                               0     r      UNASSIGNED                                          
.ds-ilm-history-7-2024.11.19-000010                                                                                             0     p      STARTED         1129    4.7mb    4.7mb 10.46.11.153 instance-0000000006
.ent-search-esqueues-me_queue_v1_mailer                                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-enterprise_search.audit-default-2024.09.17-000001                                                                      0     p      STARTED           22   51.9kb   51.9kb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_status-default-2024.10.17-000002                                                                 0     p      STARTED        41155    1.1mb    1.1mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_status-default-2024.10.17-000002                                                                 0     r      UNASSIGNED                                          
.ent-search-actastic-crawler_process_crawls                                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.cpu-default-2024.09.25-000001                                                                                0     p      STARTED        40008      2mb      2mb 10.46.11.153 instance-0000000006
.ds-metrics-system.cpu-default-2024.09.25-000001                                                                                0     r      UNASSIGNED                                          
.ent-search-actastic-app_search_invitations_v3                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-windows.perfmon-default-2024.11.02-000002                                                                           0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-windows.perfmon-default-2024.11.02-000002                                                                           0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.registry-default-2024.10.21-000002                                                                     0     p      STARTED       186086   85.9mb   85.9mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.registry-default-2024.10.21-000002                                                                     0     r      UNASSIGNED                                          
.ds-.kibana-elastic-ai-assistant-knowledge-base-default-2024.09.21-000001                                                       0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.11.20-000003                                                                         0     p      STARTED     20025444    5.2gb    5.2gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.11.20-000003                                                                         0     r      UNASSIGNED                                          
.security-7                                                                                                                     0     p      STARTED          402  562.8kb  562.8kb 10.46.11.153 instance-0000000006
.internal.alerts-security.alerts-default-000002                                                                                 0     p      STARTED          181  899.8kb  899.8kb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat-default-2024.11.20-000003                                                                    0     p      STARTED       275591   72.9mb   72.9mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat-default-2024.11.20-000003                                                                    0     r      UNASSIGNED                                          
.ds-logs-system.syslog-default-2024.10.25-000002                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-system.syslog-default-2024.10.25-000002                                                                                0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.api-default-2024.11.20-000003                                                                          0     p      STARTED         6343      7mb      7mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.11.20-000003                                                                          0     r      UNASSIGNED                                          
.geoip_databases                                                                                                                0     p      STARTED           35   37.3mb   37.3mb 10.46.11.153 instance-0000000006
.ml-anomalies-custom-auth_rare_source_ip_for_a_user                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2024.11.26-000011                                                                                      0     p      STARTED       797752  127.3mb  127.3mb 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_content_source_user_identities_v4                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-windows.powershell_operational-default-2024.10.03-000001                                                               0     p      STARTED       231353  861.1mb  861.1mb 10.46.11.153 instance-0000000006
.ds-logs-windows.powershell_operational-default-2024.10.03-000001                                                               0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.security-default-2024.10.21-000002                                                                     0     p      STARTED      9999078    1.6gb    1.6gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.10.21-000002                                                                     0     r      UNASSIGNED                                          
.ds-ilm-history-7-2024.10.29-000007                                                                                             0     p      STARTED         1037    5.6mb    5.6mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.registry-default-2024.12.20-000004                                                                     0     p      STARTED        54517   25.3mb   25.3mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.registry-default-2024.12.20-000004                                                                     0     r      UNASSIGNED                                          
.ent-search-actastic-app_search_crawler_content_metadata-content_hash-engine_oid-unique-constraint                              0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.10.21-000002                                                                          0     p      STARTED         7930    9.1mb    9.1mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.10.21-000002                                                                          0     r      UNASSIGNED                                          
.ent-search-actastic-oauth_applications_v2-uid-unique-constraint                                                                0     p      STARTED            1    4.4kb    4.4kb 10.46.11.153 instance-0000000006
.ml-anomalies-custom-v3_linux_anomalous_process_all_hosts                                                                       0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.12.30-000005                                                                         0     p      STARTED      8683510    1.9gb    1.9gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.12.30-000005                                                                         0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.filebeat-default-2024.10.21-000002                                                                    0     p      STARTED       269459   70.8mb   70.8mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat-default-2024.10.21-000002                                                                    0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.process-default-2024.09.21-000001                                                                      0     p      STARTED     37391690   18.6gb   18.6gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.09.21-000001                                                                      0     r      UNASSIGNED                                          
.ent-search-actastic-search_indices_v1                                                                                          0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.internal.alerts-observability.logs.alerts-default-000001                                                                       0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2025.01.03-000014                                                                       0     p      STARTED    139315200   50.1gb   50.1gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2025.01.03-000014                                                                       0     r      UNASSIGNED                                          
my-index                                                                                                                        0     p      STARTED            1    7.4kb    7.4kb 10.46.11.153 instance-0000000006
my-index                                                                                                                        0     r      UNASSIGNED                                          
.ds-metrics-system.uptime-default-2024.10.25-000002                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.uptime-default-2024.10.25-000002                                                                             0     r      UNASSIGNED                                          
.ds-metrics-system.process-default-2024.10.25-000002                                                                            0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.process-default-2024.10.25-000002                                                                            0     r      UNASSIGNED                                          
.ds-.kibana-elastic-ai-assistant-attack-discovery-default-2024.09.21-000001                                                     0     p      STARTED            2   12.5kb   12.5kb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.10.08-000001                                                                       0     p      STARTED      4148672    1.5gb    1.5gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.10.08-000001                                                                       0     r      UNASSIGNED                                          
.ds-logs-elastic_agent-default-2024.12.20-000004                                                                                0     p      STARTED          597  674.8kb  674.8kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent-default-2024.12.20-000004                                                                                0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.endpoint_security-default-2024.12.30-000005                                                              0     p      STARTED       438237   83.2mb   83.2mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.endpoint_security-default-2024.12.30-000005                                                              0     r      UNASSIGNED                                          
.ds-metrics-endpoint.metrics-default-2024.11.20-000003                                                                          0     p      STARTED          548    4.1mb    4.1mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metrics-default-2024.11.20-000003                                                                          0     r      UNASSIGNED                                          
.internal.alerts-observability.metrics.alerts-default-000001                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-fim.event-default-2024.12.05-000001                                                                                    0     p      STARTED     18005143    3.6gb    3.6gb 10.46.11.153 instance-0000000006
.ds-logs-fim.event-default-2024.12.05-000001                                                                                    0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.process-default-2024.10.21-000002                                                                      0     p      STARTED     16055418   11.1gb   11.1gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.10.21-000002                                                                      0     r      UNASSIGNED                                          
.ds-metrics-system.cpu-default-2024.10.25-000002                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.cpu-default-2024.10.25-000002                                                                                0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.api-default-2024.12.30-000005                                                                          0     p      STARTED         1018  897.5kb  897.5kb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.12.30-000005                                                                          0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_system_information_discovery                                                                      0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler2_configurations_v2                                                                                 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_status-default-2024.11.16-000003                                                                 0     p      STARTED        38931    1.1mb    1.1mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_status-default-2024.11.16-000003                                                                 0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_rare_metadata_user                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.fleet-policies-leader-7                                                                                                        0     p      STARTED            7   19.8kb   19.8kb 10.46.11.153 instance-0000000006
.ds-metrics-system.load-default-2024.10.25-000002                                                                               0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.load-default-2024.10.25-000002                                                                               0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_network_configuration_discovery                                                                   0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_search_groups_v4-name-unique-constraint                                                   0     p      STARTED            1    4.3kb    4.3kb 10.46.11.153 instance-0000000006
.ds-.slm-history-7-2024.11.26-000011                                                                                            0     p      STARTED          725  278.6kb  278.6kb 10.46.11.153 instance-0000000006
.ds-.lists-default-2024.09.21-000001                                                                                            0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.lists-default-2024.09.21-000001                                                                                            0     r      UNASSIGNED                                          
.ent-search-actastic-app_search_role_mappings_v5                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.transform-notifications-000002                                                                                                 0     p      STARTED         1135  373.7kb  373.7kb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.12.30-000005                                                                     0     p      STARTED      3443748  505.9mb  505.9mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.12.30-000005                                                                     0     r      UNASSIGNED                                          
.kibana_analytics_8.15.1_001                                                                                                    0     p      STARTED         1200    2.9mb    2.9mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat-default-2024.09.21-000001                                                                    0     p      STARTED       392098     90mb     90mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat-default-2024.09.21-000001                                                                    0     r      UNASSIGNED                                          
.ent-search-actastic-crawler2_process_crawls                                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.endpoint_security-default-2024.10.21-000002                                                           0     p      STARTED       141003    155mb    155mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.endpoint_security-default-2024.10.21-000002                                                           0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.library-default-2024.10.21-000002                                                                      0     p      STARTED      8890003    1.2gb    1.2gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.10.21-000002                                                                      0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.elastic_agent-default-2024.10.21-000002                                                               0     p      STARTED      1093310   63.3mb   63.3mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.elastic_agent-default-2024.10.21-000002                                                               0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.endpoint_security-default-2024.11.20-000003                                                              0     p      STARTED      2817216  366.1mb  366.1mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.endpoint_security-default-2024.11.20-000003                                                              0     r      UNASSIGNED                                          
.ds-metrics-system.network-default-2024.09.25-000001                                                                            0     p      STARTED       120018    7.5mb    7.5mb 10.46.11.153 instance-0000000006
.ds-metrics-system.network-default-2024.09.25-000001                                                                            0     r      UNASSIGNED                                          
.ds-metrics-fleet_server.agent_status-default-2024.09.17-000001                                                                 0     p      STARTED        41183    1.1mb    1.1mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_status-default-2024.09.17-000001                                                                 0     r      UNASSIGNED                                          
.ds-risk-score.risk-score-default-2024.11.22-000003                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-risk-score.risk-score-default-2024.11.22-000003                                                                             0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_system_user_discovery                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.slm-history-7-2025.01.07-000020                                                                                            0     p      STARTED          276  254.6kb  254.6kb 10.46.11.153 instance-0000000006
.ml-anomalies-custom-suspicious_login_activity                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.fleet-fileds-fromhost-meta-agent-2024.10.28-000002                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metrics-default-2024.12.20-000004                                                                          0     p      STARTED          217    1.2mb    1.2mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metrics-default-2024.12.20-000004                                                                          0     r      UNASSIGNED                                          
.ml-anomalies-custom-auth_high_count_logon_events_for_a_source_ip                                                               0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.12.20-000004                                                                     0     p      STARTED      2601452  461.3mb  461.3mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.12.20-000004                                                                     0     r      UNASSIGNED                                          
.slo-observability.summary-v3.3.temp                                                                                            0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.10-000009                                                                       0     p      STARTED    124537600     50gb     50gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.10-000009                                                                       0     r      UNASSIGNED                                          
.ent-search-actastic-app_search_crawler_content_url_metadata                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.process-default-2024.09.25-000001                                                                            0     p      STARTED       326358    127mb    127mb 10.46.11.153 instance-0000000006
.ds-metrics-system.process-default-2024.09.25-000001                                                                            0     r      UNASSIGNED                                          
.ds-metrics-endpoint.metadata-default-2024.11.20-000003                                                                         0     p      STARTED          548  906.6kb  906.6kb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metadata-default-2024.11.20-000003                                                                         0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_rare_metadata_process                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
logs-cloud_security_posture.scores-default                                                                                      0     p      STARTED        29138    2.2mb    2.2mb 10.46.11.153 instance-0000000006
logs-cloud_security_posture.scores-default                                                                                      0     r      UNASSIGNED                                          
.ds-logs-elastic_agent-default-2024.09.21-000001                                                                                0     p      STARTED       209720   10.3mb   10.3mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent-default-2024.09.21-000001                                                                                0     r      UNASSIGNED                                          
.ds-.kibana-reporting-2024.11.29-000001                                                                                         0     p      STARTED          229  419.1mb  419.1mb 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler2_domains                                                                                           0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.fleet-servers-7                                                                                                                0     p      STARTED            1    8.1kb    8.1kb 10.46.11.153 instance-0000000006
.apm-custom-link                                                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-app_search_api_token_engines                                                                               0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.11.15-000003                                                                       0     p      STARTED    127096000     50gb     50gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.11.15-000003                                                                       0     r      UNASSIGNED                                          
.ent-search-actastic-users_v7-auth_source-elasticsearch_username-unique-constraint                                              0     p      STARTED            2    8.5kb    8.5kb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.09.21-000001                                                                      0     p      STARTED      8182456    1.1gb    1.1gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.09.21-000001                                                                      0     r      UNASSIGNED                                          
.ds-risk-score.risk-score-default-2024.10.23-000002                                                                             0     p      STARTED         3153    3.9mb    3.9mb 10.46.11.153 instance-0000000006
.ds-risk-score.risk-score-default-2024.10.23-000002                                                                             0     r      UNASSIGNED                                          
.fleet-agents-7                                                                                                                 0     p      STARTED           37  374.2kb  374.2kb 10.46.11.153 instance-0000000006
.ent-search-esqueues-me_queue_v1_failed                                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2024.10.22-000006                                                                                      0     p      STARTED       818150  129.3mb  129.3mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat_input-default-2024.12.20-000004                                                              0     p      STARTED       543670  302.5mb  302.5mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat_input-default-2024.12.20-000004                                                              0     r      UNASSIGNED                                          
.slo-observability.summary-v3.3                                                                                                 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_versions-default-2024.11.16-000003                                                               0     p      STARTED        95177    2.3mb    2.3mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_versions-default-2024.11.16-000003                                                               0     r      UNASSIGNED                                          
.ml-anomalies-custom-auth_rare_user                                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-ilm-history-7-2024.11.05-000008                                                                                             0     p      STARTED         1015    5.6mb    5.6mb 10.46.11.153 instance-0000000006
.ds-ilm-history-7-2024.12.24-000016                                                                                             0     p      STARTED         1105    4.9mb    4.9mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent-default-2024.10.21-000002                                                                                0     p      STARTED          253  658.6kb  658.6kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent-default-2024.10.21-000002                                                                                0     r      UNASSIGNED                                          
.ent-search-actastic-oauth_access_tokens_v2                                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.internal.alerts-observability.slo.alerts-default-000001                                                                        0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2024.10.25-000002                                                                       0     p      STARTED          279  369.3kb  369.3kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2024.10.25-000002                                                                       0     r      UNASSIGNED                                          
.ds-ilm-history-7-2024.12.10-000013                                                                                             0     p      STARTED            8   11.9kb   11.9kb 10.46.11.153 instance-0000000006
.ent-search-actastic-app_search_api_tokens_v3-authentication_token-unique-constraint                                            0     p      STARTED            2    4.9kb    4.9kb 10.46.11.153 instance-0000000006
.kibana_security_solution_8.15.1_001                                                                                            0     p      STARTED        11796   19.4mb   19.4mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metrics-default-2024.10.21-000002                                                                          0     p      STARTED          490    3.3mb    3.3mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metrics-default-2024.10.21-000002                                                                          0     r      UNASSIGNED                                          
.ml-anomalies-custom-auth_rare_hour_for_a_user                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-ilm-history-7-2024.12.31-000018                                                                                             0     p      STARTED         1039    5.1mb    5.1mb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.28-000012                                                                       0     p      STARTED     39611200   15.4gb   15.4gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.28-000012                                                                       0     r      UNASSIGNED                                          
.metrics-endpoint.metadata_united_default                                                                                       0     p      STARTED           37  744.1kb  744.1kb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.11.20-000003                                                                      0     p      STARTED      9922784    1.3gb    1.3gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.11.20-000003                                                                      0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.registry-default-2024.09.21-000001                                                                     0     p      STARTED      4219411  749.8mb  749.8mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.registry-default-2024.09.21-000001                                                                     0     r      UNASSIGNED                                          
.ds-.slm-history-7-2024.10.29-000007                                                                                            0     p      STARTED          673  278.1kb  278.1kb 10.46.11.153 instance-0000000006
.ds-logs-windows.powershell_operational-default-2024.11.02-000002                                                               0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-windows.powershell_operational-default-2024.11.02-000002                                                               0     r      UNASSIGNED                                          
.apm-source-map                                                                                                                 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.10.21-000002                                                                           0     p      STARTED          369    1.7mb    1.7mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.10.21-000002                                                                           0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_anomalous_user_name                                                                               0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ml-anomalies-custom-v3_linux_network_connection_discovery                                                                      0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ml-anomalies-custom-auth_high_count_logon_events                                                                               0     p      STARTED        29587    9.9mb    9.9mb 10.46.11.153 instance-0000000006
.internal.alerts-observability.threshold.alerts-default-000001                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.10.21-000002                                                                      0     p      STARTED     18927230    2.3gb    2.3gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.10.21-000002                                                                      0     r      UNASSIGNED                                          
.ml-annotations-000001                                                                                                          0     p      STARTED           25   42.1kb   42.1kb 10.46.11.153 instance-0000000006
.ds-.fleet-actions-results-2024.12.20-000004                                                                                    0     p      STARTED            8   36.8kb   36.8kb 10.46.11.153 instance-0000000006
.ml-anomalies-custom-v3_rare_process_by_host_linux                                                                              0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-winlogbeat-8.15.2-2024.10.08-000001                                                                                         0     p      STARTED     27630107   31.7gb   31.7gb 10.46.11.153 instance-0000000006
.ds-winlogbeat-8.15.2-2024.10.08-000001                                                                                         0     r      UNASSIGNED                                          
.ds-.fleet-fileds-fromhost-data-agent-2024.10.19-000005                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2024.12.03-000012                                                                                      0     p      STARTED       797764  128.2mb  128.2mb 10.46.11.153 instance-0000000006
.ent-search-actastic-search_relevance_suggestions                                                                               0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2025.01.03-000005                                                                       0     p      STARTED          233  167.3kb  167.3kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2025.01.03-000005                                                                       0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.filebeat-default-2024.12.20-000004                                                                    0     p      STARTED       231997   70.3mb   70.3mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat-default-2024.12.20-000004                                                                    0     r      UNASSIGNED                                          
.ds-.kibana-event-log-ds-2024.11.12-000009                                                                                      0     p      STARTED       797792  125.1mb  125.1mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.auditbeat-default-2024.12.30-000002                                                                      0     p      STARTED        97294   13.5mb   13.5mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.auditbeat-default-2024.12.30-000002                                                                      0     r      UNASSIGNED                                          
.ent-search-actastic-workplace_search_accounts_v16-user_oid-unique-constraint                                                   0     p      STARTED            2    8.4kb    8.4kb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.11.20-000003                                                                     0     p      STARTED      8976782    1.3gb    1.3gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.security-default-2024.11.20-000003                                                                     0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.file-default-2024.12.20-000004                                                                         0     p      STARTED      7075028    1.9gb    1.9gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.12.20-000004                                                                         0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.registry-default-2024.12.30-000005                                                                     0     p      STARTED        64728   11.4mb   11.4mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.registry-default-2024.12.30-000005                                                                     0     r      UNASSIGNED                                          
.ds-.kibana-event-log-ds-2024.10.29-000007                                                                                      0     p      STARTED       806288  126.6mb  126.6mb 10.46.11.153 instance-0000000006
.transform-internal-007                                                                                                         0     p      STARTED          181  153.2kb  153.2kb 10.46.11.153 instance-0000000006
.ds-.kibana-elastic-ai-assistant-anonymization-fields-default-2024.09.21-000001                                                 0     p      STARTED          100   13.1kb   13.1kb 10.46.11.153 instance-0000000006
.internal.alerts-observability.apm.alerts-default-000001                                                                        0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.process.summary-default-2024.10.25-000002                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.process.summary-default-2024.10.25-000002                                                                    0     r      UNASSIGNED

Oolong · January 10, 2025, 5:52pm

.ds-.slm-history-7-2024.12.03-000012                                                                                            0     p      STARTED          669  337.4kb  337.4kb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.03-000007                                                                       0     p      STARTED    124609600   50.1gb   50.1gb 10.46.10.135 instance-0000000003
.ent-search-actastic-oauth_access_tokens_v2-refresh_token-unique-constraint                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.slm-history-7-2024.12.17-000014                                                                                            0     p      STARTED          716  315.8kb  315.8kb 10.46.11.153 instance-0000000006
.ml-anomalies-custom-v3_linux_rare_user_compiler                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_versions-default-2024.12.16-000004                                                               0     p      STARTED        83515    2.2mb    2.2mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_versions-default-2024.12.16-000004                                                               0     r      UNASSIGNED                                          
.ds-.slm-history-7-2024.12.31-000018                                                                                            0     p      STARTED          673  278.6kb  278.6kb 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_accounts_v16                                                                              0     p      STARTED            2   16.3kb   16.3kb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metadata-default-2024.12.20-000004                                                                         0     p      STARTED          217  839.6kb  839.6kb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metadata-default-2024.12.20-000004                                                                         0     r      UNASSIGNED                                          
.ds-.slm-history-7-2024.10.22-000006                                                                                            0     p      STARTED          672  353.5kb  353.5kb 10.46.11.153 instance-0000000006
.ent-search-actastic-synonyms                                                                                                   0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-db-lock-20200304                                                                                                    0     p      STARTED            0     263b     263b 10.46.11.153 instance-0000000006
.ds-metrics-system.uptime-default-2024.09.25-000001                                                                             0     p      STARTED        40008    1.4mb    1.4mb 10.46.11.153 instance-0000000006
.ds-metrics-system.uptime-default-2024.09.25-000001                                                                             0     r      UNASSIGNED                                          
.ds-.slm-history-7-2024.10.08-000004                                                                                            0     p      STARTED          672  272.5kb  272.5kb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.metricbeat-default-2024.10.21-000002                                                                  0     p      STARTED       454605  115.4mb  115.4mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.metricbeat-default-2024.10.21-000002                                                                  0     r      UNASSIGNED                                          
.ds-metrics-endpoint.metrics-default-2024.09.21-000001                                                                          0     p      STARTED          483    3.1mb    3.1mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metrics-default-2024.09.21-000001                                                                          0     r      UNASSIGNED                                          
.ds-.slm-history-7-2024.11.12-000009                                                                                            0     p      STARTED          672  272.5kb  272.5kb 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_api_tokens                                                                                0     p      STARTED            1    7.1kb    7.1kb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.30-000013                                                                       0     p      STARTED    140460800     50gb     50gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.30-000013                                                                       0     r      UNASSIGNED                                          
.ent-search-actastic-workplace_search_pre_content_sources_v3                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.endpoint_security-default-2024.12.20-000004                                                           0     p      STARTED       183792   99.9mb   99.9mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.endpoint_security-default-2024.12.20-000004                                                           0     r      UNASSIGNED                                          
.ds-logs-windows.powershell-default-2024.10.03-000001                                                                           0     p      STARTED       168493  149.7mb  149.7mb 10.46.11.153 instance-0000000006
.ds-logs-windows.powershell-default-2024.10.03-000001                                                                           0     r      UNASSIGNED                                          
.fleet-policies-7                                                                                                               0     p      STARTED          110  490.7kb  490.7kb 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler2_configurations_v2-index_name-unique-constraint                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.slm-history-7-2024.12.24-000016                                                                                            0     p      STARTED          672  273.1kb  273.1kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.endpoint_security-default-2024.09.21-000001                                                              0     p      STARTED      1631593    193mb    193mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.endpoint_security-default-2024.09.21-000001                                                              0     r      UNASSIGNED                                          
.internal.alerts-ml.anomaly-detection.alerts-default-000001                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-app_search_document_positions_v3                                                                           0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.auditbeat-default-2024.12.05-000001                                                                   0     p      STARTED       206961   52.2mb   52.2mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.auditbeat-default-2024.12.05-000001                                                                   0     r      UNASSIGNED                                          
.ds-.kibana-event-log-ds-2024.12.24-000016                                                                                      0     p      STARTED       799327  127.2mb  127.2mb 10.46.11.153 instance-0000000006
.ds-metrics-system.filesystem-default-2024.09.25-000001                                                                         0     p      STARTED        86697    4.2mb    4.2mb 10.46.11.153 instance-0000000006
.ds-metrics-system.filesystem-default-2024.09.25-000001                                                                         0     r      UNASSIGNED                                          
.ent-search-esqueues-me_queue_v1_process_crawl                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.internal.alerts-observability.uptime.alerts-default-000001                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_search_groups_v4                                                                          0     p      STARTED            1    5.4kb    5.4kb 10.46.11.153 instance-0000000006
.slo-observability.sli-v3.3                                                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.kibana_task_manager_8.15.1_001                                                                                                 0     p      STARTED           87  219.3kb  219.3kb 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2024.11.05-000008                                                                                      0     p      STARTED       797822  125.5mb  125.5mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.11.20-000003                                                                           0     p      STARTED          475    2.5mb    2.5mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.11.20-000003                                                                           0     r      UNASSIGNED                                          
.ds-.fleet-actions-results-2024.09.21-000001                                                                                    0     p      STARTED           37  143.4kb  143.4kb 10.46.11.153 instance-0000000006
.apm-agent-configuration                                                                                                        0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2024.12.10-000013                                                                                      0     p      STARTED       137198   25.1mb   25.1mb 10.46.11.153 instance-0000000006
.ent-search-actastic-app_search_document_position_queries_v4                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.12.30-000005                                                                      0     p      STARTED      5951940    3.7gb    3.7gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.12.30-000005                                                                      0     r      UNASSIGNED                                          
.ds-logs-fortinet_fortigate.log-default-2024.11.29-000006                                                                       0     p      STARTED    126294400     50gb     50gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.11.29-000006                                                                       0     r      UNASSIGNED                                          
logs-cloud_security_posture.findings_latest-default                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
logs-cloud_security_posture.findings_latest-default                                                                             0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.elastic_agent-default-2024.09.21-000001                                                               0     p      STARTED      1448180   77.6mb   77.6mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.elastic_agent-default-2024.09.21-000001                                                               0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_anomalous_network_activity                                                                        0     p      STARTED            3   36.9kb   36.9kb 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler_crawl_requests_v7                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.kibana_ingest_8.15.1_001                                                                                                       0     p      STARTED         1539   12.9mb   12.9mb 10.46.11.153 instance-0000000006
.ds-.logs-deprecation.elasticsearch-default-2024.12.16-000005                                                                   0     p      STARTED          114    254kb    254kb 10.46.11.153 instance-0000000006
.ent-search-esqueues-me_worker_v1                                                                                               0     p      STARTED            1    3.6kb    3.6kb 10.46.11.153 instance-0000000006
.fleet-secrets-7                                                                                                                0     p      STARTED            0     260b     260b 10.46.11.153 instance-0000000006
.ds-risk-score.risk-score-default-2024.09.23-000001                                                                             0     p      STARTED         1213  639.7kb  639.7kb 10.46.11.153 instance-0000000006
.ds-risk-score.risk-score-default-2024.09.23-000001                                                                             0     r      UNASSIGNED                                          
.ml-config                                                                                                                      0     p      STARTED           42   86.4kb   86.4kb 10.46.11.153 instance-0000000006
.fleet-actions-7                                                                                                                0     p      STARTED           18  114.3kb  114.3kb 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_invitations_v3                                                                            0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-telemetry_status_v3                                                                                        0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-ilm-history-7-2024.12.03-000012                                                                                             0     p      STARTED         1037    5.6mb    5.6mb 10.46.11.153 instance-0000000006
.ml-anomalies-custom-v3_linux_rare_sudo_user                                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.logs-deprecation.elasticsearch-default-2024.11.16-000003                                                                   0     p      STARTED           23  102.9kb  102.9kb 10.46.11.153 instance-0000000006
.ent-search-actastic-users_v7                                                                                                   0     p      STARTED            2   20.8kb   20.8kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent-default-2024.11.20-000003                                                                                0     p      STARTED         5871    1.7mb    1.7mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent-default-2024.11.20-000003                                                                                0     r      UNASSIGNED                                          
.ds-logs-fortinet_fortigate.log-default-2024.12.21-000010                                                                       0     p      STARTED    127041600     50gb     50gb 10.46.10.135 instance-0000000003
.ds-metrics-elastic_agent.filebeat_input-default-2024.10.21-000002                                                              0     p      STARTED       552635  477.6mb  477.6mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat_input-default-2024.10.21-000002                                                              0     r      UNASSIGNED                                          
.ent-search-actastic-oauth_access_grants_v2                                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.06-000008                                                                       0     p      STARTED    125742400     50gb     50gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.06-000008                                                                       0     r      UNASSIGNED                                          
.ent-search-actastic-crawler2_content_metadata-configuration_oid-content_hash-unique-constraint                                 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2024.09.25-000001                                                                       0     p      STARTED         3203    2.7mb    2.7mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2024.09.25-000001                                                                       0     r      UNASSIGNED                                          
.ent-search-actastic-app_search_accounts_v12                                                                                    0     p      STARTED            1    7.2kb    7.2kb 10.46.11.153 instance-0000000006
.tasks                                                                                                                          0     p      STARTED            9   49.7kb   49.7kb 10.46.11.153 instance-0000000006
.ent-search-actastic-app_search_api_tokens_v3                                                                                   0     p      STARTED            2     19kb     19kb 10.46.11.153 instance-0000000006
.ds-metrics-windows.service-default-2024.11.02-000002                                                                           0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-windows.service-default-2024.11.02-000002                                                                           0     r      UNASSIGNED                                          
.ds-metrics-system.filesystem-default-2024.10.25-000002                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.filesystem-default-2024.10.25-000002                                                                         0     r      UNASSIGNED                                          
.ds-ilm-history-7-2024.10.22-000006                                                                                             0     p      STARTED         1120    5.6mb    5.6mb 10.46.11.153 instance-0000000006
.ds-logs-enterprise_search.audit-default-2024.10.17-000002                                                                      0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.12.20-000004                                                                      0     p      STARTED      2089905  434.4mb  434.4mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.12.20-000004                                                                      0     r      UNASSIGNED                                          
.ent-search-actastic-crawler_domains_v6-engine_oid-name-unique-constraint                                                       0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
risk-score.risk-score-latest-default                                                                                            0     p      STARTED            6   61.1kb   61.1kb 10.46.11.153 instance-0000000006
risk-score.risk-score-latest-default                                                                                            0     r      UNASSIGNED                                          
.ds-metrics-fleet_server.agent_status-default-2024.12.16-000004                                                                 0     p      STARTED        33542    1.1mb    1.1mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_status-default-2024.12.16-000004                                                                 0     r      UNASSIGNED                                          
.ent-search-actastic-search_relevance_suggestion_update_process_v1                                                              0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-windows.service-default-2024.10.03-000001                                                                           0     p      STARTED     20379035  718.3mb  718.3mb 10.46.11.153 instance-0000000006
.ds-metrics-windows.service-default-2024.10.03-000001                                                                           0     r      UNASSIGNED                                          
.ds-ilm-history-7-2024.11.12-000009                                                                                             0     p      STARTED         1056    4.9mb    4.9mb 10.46.11.153 instance-0000000006
.ent-search-actastic-reindex_jobs_v3                                                                                            0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.kibana_usage_counters_8.17.0_001                                                                                               0     p      STARTED          358  105.5kb  105.5kb 10.46.11.153 instance-0000000006
.ds-metrics-system.fsstat-default-2024.09.25-000001                                                                             0     p      STARTED         6669  789.8kb  789.8kb 10.46.11.153 instance-0000000006
.ds-metrics-system.fsstat-default-2024.09.25-000001                                                                             0     r      UNASSIGNED                                          
.ds-metrics-system.memory-default-2024.09.25-000001                                                                             0     p      STARTED        40007      2mb      2mb 10.46.11.153 instance-0000000006
.ds-metrics-system.memory-default-2024.09.25-000001                                                                             0     r      UNASSIGNED                                          
.internal.alerts-default.alerts-default-000001                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.registry-default-2024.11.20-000003                                                                     0     p      STARTED       183009   75.3mb   75.3mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.registry-default-2024.11.20-000003                                                                     0     r      UNASSIGNED                                          
.ds-logs-fim.event-default-2024.12.30-000002                                                                                    0     p      STARTED      8174401    1.4gb    1.4gb 10.46.11.153 instance-0000000006
.ds-logs-fim.event-default-2024.12.30-000002                                                                                    0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.metricbeat-default-2024.11.20-000003                                                                  0     p      STARTED       472465  120.1mb  120.1mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.metricbeat-default-2024.11.20-000003                                                                  0     r      UNASSIGNED                                          
.ds-ilm-history-7-2024.11.26-000011                                                                                             0     p      STARTED         1017    5.6mb    5.6mb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.11.19-000004                                                                       0     p      STARTED    124153600   50.1gb   50.1gb 10.46.10.135 instance-0000000003
.ds-logs-fortinet_fortigate.log-default-2024.11.19-000004                                                                       0     r      UNASSIGNED                                          
.internal.alerts-security.alerts-default-000001                                                                                 0     p      STARTED            5   86.8kb   86.8kb 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_pre_content_sources_v3-context-workplace_search_account_id-service_type-unique-constraint 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.12.20-000004                                                                      0     p      STARTED      5084498    3.7gb    3.7gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.12.20-000004                                                                      0     r      UNASSIGNED                                          
.ds-.fleet-actions-results-2024.10.21-000002                                                                                    0     p      STARTED            1    4.8kb    4.8kb 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2025.01.07-000020                                                                                      0     p      STARTED       331553   57.9mb   57.9mb 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler_domains_v6                                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-ilm-history-7-2024.10.15-000005                                                                                             0     p      STARTED          984      4mb      4mb 10.46.11.153 instance-0000000006
.ds-logs-system.syslog-default-2024.09.25-000001                                                                                0     p      STARTED       475674   24.7mb   24.7mb 10.46.11.153 instance-0000000006
.ds-logs-system.syslog-default-2024.09.25-000001                                                                                0     r      UNASSIGNED                                          
logs-cloud_security_posture.vulnerabilities_latest-default                                                                      0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
logs-cloud_security_posture.vulnerabilities_latest-default                                                                      0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.library-default-2024.11.20-000003                                                                      0     p      STARTED      8363480    1.1gb    1.1gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.11.20-000003                                                                      0     r      UNASSIGNED                                          
.security-profile-8                                                                                                             0     p      STARTED            3   21.8kb   21.8kb 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler2_content_url_metadata                                                                              0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ml-anomalies-custom-auth_high_count_logon_fails                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.kibana_8.15.1_001                                                                                                              0     p      STARTED         1532  201.8kb  201.8kb 10.46.11.153 instance-0000000006
.ds-.kibana-elastic-ai-assistant-prompts-default-2024.09.21-000001                                                              0     p      STARTED           16   20.8kb   20.8kb 10.46.11.153 instance-0000000006
.ent-search-actastic-crawler2_domains-configuration_oid-name-unique-constraint                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ml-anomalies-custom-v3_linux_system_process_discovery                                                                          0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-esqueues-me_queue_v1_process_crawl2                                                                                 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
metrics-endpoint.metadata_current_default                                                                                       0     p      STARTED           11  209.5kb  209.5kb 10.46.11.153 instance-0000000006
.ds-metrics-windows.perfmon-default-2024.10.03-000001                                                                           0     p      STARTED    156551091   11.4gb   11.4gb 10.46.11.153 instance-0000000006
.ds-metrics-windows.perfmon-default-2024.10.03-000001                                                                           0     r      UNASSIGNED                                          
.ent-search-actastic-users_v7-email-unique-constraint                                                                           0     p      STARTED            2    8.6kb    8.6kb 10.46.11.153 instance-0000000006
.ds-metrics-system.memory-default-2024.10.25-000002                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.memory-default-2024.10.25-000002                                                                             0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.filebeat-default-2024.11.24-000003                                                                       0     p      STARTED         4685    1.1mb    1.1mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2024.11.24-000003                                                                       0     r      UNASSIGNED                                          
.ds-logs-enterprise_search.api-default-2024.09.24-000002                                                                        0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.09.21-000001                                                                           0     p      STARTED          379    2.3mb    2.3mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.09.21-000001                                                                           0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.network-default-2024.09.21-000001                                                                      0     p      STARTED     22795166    2.7gb    2.7gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.09.21-000001                                                                      0     r      UNASSIGNED                                          
.ds-metrics-system.diskio-default-2024.09.25-000001                                                                             0     p      STARTED       840147   29.4mb   29.4mb 10.46.11.153 instance-0000000006
.ds-metrics-system.diskio-default-2024.09.25-000001                                                                             0     r      UNASSIGNED                                          
.ds-.slm-history-7-2024.11.05-000008                                                                                            0     p      STARTED          672  272.9kb  272.9kb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.09.21-000001                                                                          0     p      STARTED         7188    7.8mb    7.8mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.09.21-000001                                                                          0     r      UNASSIGNED                                          
.ds-.fleet-fileds-fromhost-meta-agent-2024.09.28-000001                                                                         0     p      STARTED            3   21.3kb   21.3kb 10.46.11.153 instance-0000000006
.ds-.fleet-actions-results-2024.11.20-000003                                                                                    0     p      STARTED           39    131kb    131kb 10.46.11.153 instance-0000000006
.elastic-connectors-sync-jobs-v1                                                                                                0     p      STARTED            0     248b     248b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.11.20-000003                                                                      0     p      STARTED     15737256   10.9gb   10.9gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.process-default-2024.11.20-000003                                                                      0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.metricbeat-default-2024.10.21-000002                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.metricbeat-default-2024.10.21-000002                                                                     0     r      UNASSIGNED                                          
.ds-.kibana-event-log-ds-2024.12.31-000018                                                                                      0     p      STARTED       805454  130.5mb  130.5mb 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_content_sources_v23                                                                       0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.12.30-000005                                                                      0     p      STARTED      3135011  381.9mb  381.9mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.12.30-000005                                                                      0     r      UNASSIGNED                                          
.ds-.kibana-event-log-ds-2024.11.19-000010                                                                                      0     p      STARTED       781359  122.7mb  122.7mb 10.46.11.153 instance-0000000006
.ds-metrics-system.load-default-2024.09.25-000001                                                                               0     p      STARTED        40008    1.3mb    1.3mb 10.46.11.153 instance-0000000006
.ds-metrics-system.load-default-2024.09.25-000001                                                                               0     r      UNASSIGNED                                          
.internal.alerts-security.alerts-default-000003                                                                                 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.kibana-elastic-ai-assistant-conversations-default-2024.09.21-000001                                                        0     p      STARTED            2    8.7kb    8.7kb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.24-000011                                                                       0     p      STARTED    126817600     50gb     50gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.12.24-000011                                                                       0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.endpoint_security-default-2024.10.21-000002                                                              0     p      STARTED       377820  306.4mb  306.4mb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.endpoint_security-default-2024.10.21-000002                                                              0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.filebeat-default-2024.12.24-000004                                                                       0     p      STARTED          300  298.1kb  298.1kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.filebeat-default-2024.12.24-000004                                                                       0     r      UNASSIGNED                                          
.ml-anomalies-custom-v3_linux_anomalous_network_port_activity                                                                   0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.metricbeat-default-2024.12.20-000004                                                                  0     p      STARTED       402812  109.1mb  109.1mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.metricbeat-default-2024.12.20-000004                                                                  0     r      UNASSIGNED                                          
.ds-.kibana-event-log-ds-2024.10.15-000005                                                                                      0     p      STARTED       680656  106.3mb  106.3mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.12.20-000004                                                                          0     p      STARTED         1866    2.6mb    2.6mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.api-default-2024.12.20-000004                                                                          0     r      UNASSIGNED                                          
.ent-search-actastic-oauth_applications_v2                                                                                      0     p      STARTED            1    8.9kb    8.9kb 10.46.11.153 instance-0000000006
.ent-search-actastic-secret_keeper_secrets                                                                                      0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ml-state-000001                                                                                                                0     p      STARTED           22    1.4mb    1.4mb 10.46.11.153 instance-0000000006
.ent-search-actastic-workplace_search_organizations_v17                                                                         0     p      STARTED            1    9.1kb    9.1kb 10.46.11.153 instance-0000000006
.ent-search-actastic-search_relevance_suggestions-document_position_id-unique-constraint                                        0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat_input-default-2024.09.21-000001                                                              0     p      STARTED       986240  378.7mb  378.7mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.filebeat_input-default-2024.09.21-000001                                                              0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.file-default-2024.10.21-000002                                                                         0     p      STARTED     21432267    5.5gb    5.5gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.10.21-000002                                                                         0     r      UNASSIGNED                                          
.ds-logs-elastic_agent.metricbeat-default-2024.09.21-000001                                                                     0     p      STARTED         1288 1010.9kb 1010.9kb 10.46.11.153 instance-0000000006
.ds-logs-elastic_agent.metricbeat-default-2024.09.21-000001                                                                     0     r      UNASSIGNED                                          
.elastic-connectors-v1                                                                                                          0     p      STARTED            0     248b     248b 10.46.11.153 instance-0000000006
.ds-.slm-history-7-2024.11.19-000010                                                                                            0     p      STARTED          607  270.1kb  270.1kb 10.46.11.153 instance-0000000006
.ds-metrics-system.diskio-default-2024.10.25-000002                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.diskio-default-2024.10.25-000002                                                                             0     r      UNASSIGNED                                          
.ds-logs-fortinet_fortigate.log-default-2024.11.07-000002                                                                       0     p      STARTED    129617375     50gb     50gb 10.46.10.135 instance-0000000003
.ds-logs-fortinet_fortigate.log-default-2024.11.07-000002                                                                       0     r      UNASSIGNED                                          
.ds-metrics-system.fsstat-default-2024.10.25-000002                                                                             0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.fsstat-default-2024.10.25-000002                                                                             0     r      UNASSIGNED                                          
.ds-metrics-system.network-default-2024.10.25-000002                                                                            0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.network-default-2024.10.25-000002                                                                            0     r      UNASSIGNED                                          
.kibana-observability-ai-assistant-conversations-000001                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ent-search-actastic-togo_migrations_v1                                                                                         0     p      STARTED           36      8kb      8kb 10.46.11.153 instance-0000000006
.kibana_alerting_cases_8.15.1_001                                                                                               0     p      STARTED         1266    9.2mb    9.2mb 10.46.11.153 instance-0000000006
.ent-search-actastic-engines_v26                                                                                                0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2024.12.17-000014                                                                                      0     p      STARTED       797742  126.6mb  126.6mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.elastic_agent-default-2024.12.20-000004                                                               0     p      STARTED      1147393   68.8mb   68.8mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.elastic_agent-default-2024.12.20-000004                                                               0     r      UNASSIGNED                                          
.ds-ilm-history-7-2024.10.08-000004                                                                                             0     p      STARTED          516    2.5mb    2.5mb 10.46.11.153 instance-0000000006
.ent-search-actastic-connectors_jobs_v5                                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.kibana_security_session_1                                                                                                      0     p      STARTED            1    6.9kb    6.9kb 10.46.11.153 instance-0000000006
.ds-winlogbeat-8.15.3-2024.10.18-000001                                                                                         0     p      STARTED     35930064   42.7gb   42.7gb 10.46.11.153 instance-0000000006
.ds-winlogbeat-8.15.3-2024.10.18-000001                                                                                         0     r      UNASSIGNED                                          
.ds-metrics-endpoint.metadata-default-2024.10.21-000002                                                                         0     p      STARTED          490    1.2mb    1.2mb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metadata-default-2024.10.21-000002                                                                         0     r      UNASSIGNED                                          
.ds-logs-endpoint.events.network-default-2024.12.30-000005                                                                      0     p      STARTED      2950951  372.2mb  372.2mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.network-default-2024.12.30-000005                                                                      0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.metricbeat-default-2024.09.21-000001                                                                  0     p      STARTED       660282  154.1mb  154.1mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.metricbeat-default-2024.09.21-000001                                                                  0     r      UNASSIGNED                                          
.ent-search-actastic-crawler2_extraction_rules                                                                                  0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ml-notifications-000002                                                                                                        0     p      STARTED          274  195.4kb  195.4kb 10.46.11.153 instance-0000000006
.ds-ilm-history-7-2025.01.07-000020                                                                                             0     p      STARTED          415    2.1mb    2.1mb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.11.22-000005                                                                       0     p      STARTED    124668171     50gb     50gb 10.46.11.153 instance-0000000006
.ds-logs-fortinet_fortigate.log-default-2024.11.22-000005                                                                       0     r      UNASSIGNED                                          
.ds-metrics-system.socket_summary-default-2024.09.25-000001                                                                     0     p      STARTED        40007    2.3mb    2.3mb 10.46.11.153 instance-0000000006
.ds-metrics-system.socket_summary-default-2024.09.25-000001                                                                     0     r      UNASSIGNED                                          
.fleet-artifacts-7                                                                                                              0     p      STARTED           15   14.9kb   14.9kb 10.46.11.153 instance-0000000006
.ds-.slm-history-7-2024.12.10-000013                                                                                            0     p      STARTED            1    5.8kb    5.8kb 10.46.11.153 instance-0000000006
.async-search                                                                                                                   0     p      STARTED            0     262b     262b 10.46.11.153 instance-0000000006
.ds-ilm-history-7-2024.12.17-000014                                                                                             0     p      STARTED         1145    4.9mb    4.9mb 10.46.11.153 instance-0000000006
.internal.alerts-stack.alerts-default-000001                                                                                    0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-.kibana-event-log-ds-2024.10.08-000004                                                                                      0     p      STARTED       512228   80.8mb   80.8mb 10.46.11.153 instance-0000000006
.ent-search-actastic-app_search_role_mapping_engines_v4                                                                         0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metadata-default-2024.09.21-000001                                                                         0     p      STARTED          483  902.4kb  902.4kb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.metadata-default-2024.09.21-000001                                                                         0     r      UNASSIGNED                                          
.ds-metrics-fleet_server.agent_versions-default-2024.10.17-000002                                                               0     p      STARTED       123422    2.9mb    2.9mb 10.46.11.153 instance-0000000006
.ds-metrics-fleet_server.agent_versions-default-2024.10.17-000002                                                               0     r      UNASSIGNED                                          
.ent-search-actastic-crawler2_crawl_requests_v2                                                                                 0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.12.20-000004                                                                           0     p      STARTED          103  792.3kb  792.3kb 10.46.11.153 instance-0000000006
.ds-metrics-endpoint.policy-default-2024.12.20-000004                                                                           0     r      UNASSIGNED                                          
.fleet-enrollment-api-keys-7                                                                                                    0     p      STARTED            7   46.6kb   46.6kb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.09.21-000001                                                                         0     p      STARTED     45779855    8.4gb    8.4gb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.file-default-2024.09.21-000001                                                                         0     r      UNASSIGNED                                          
.ds-metrics-elastic_agent.auditbeat-default-2025.01.04-000002                                                                   0     p      STARTED        51189     18mb     18mb 10.46.11.153 instance-0000000006
.ds-metrics-elastic_agent.auditbeat-default-2025.01.04-000002                                                                   0     r      UNASSIGNED                                          
.internal.alerts-ml.anomaly-detection-health.alerts-default-000001                                                              0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.12.20-000004                                                                      0     p      STARTED      2521509  488.3mb  488.3mb 10.46.11.153 instance-0000000006
.ds-logs-endpoint.events.library-default-2024.12.20-000004                                                                      0     r      UNASSIGNED                                          
.ds-metrics-system.socket_summary-default-2024.10.25-000002                                                                     0     p      STARTED            0     250b     250b 10.46.11.153 instance-0000000006
.ds-metrics-system.socket_summary-default-2024.10.25-000002                                                                     0     r      UNASSIGNED

Oolong · January 10, 2025, 6:12pm

This suggestion worked. When i switch off the replica the size goes away.

In the case where i am intending to use the cold tier as a long term storage, do i need to have replicas ?

Christian_Dahlqvist · January 10, 2025, 6:15pm

In order to have replicas in any tier you need to have more than one node in that tier.

Oolong · January 10, 2025, 6:28pm

Thank you i will look into it.

Topic		Replies	Views
ILM on single-node? Elasticsearch ilm-index-lifecycle-management	7	451	June 19, 2023
Hot nodes full Elasticsearch ilm-index-lifecycle-management	9	1245	December 23, 2022
Moving indices back to ilm hot phase Elasticsearch ilm-index-lifecycle-management	4	2504	May 26, 2021
Ingest node disc usage keeps rising Elasticsearch ilm-index-lifecycle-management	7	1287	October 18, 2021
ES custom ILM policy with cumulative index or disk size Elasticsearch ilm-index-lifecycle-management	4	341	March 22, 2023

Moving indices from Hot tier to Cold does not reduce hot tier size

Related topics