I recently added warm nodes to our deployments in elastic cloud in prep to add ILM Policies (nothing added yet).
Last night, I got low space warnings and noticed almost all of the space on warm nodes was consumed with newly created indexes from our EC2 Logs.
I understand that I could add node.ingest = false in the yaml for dense storage. But trying to understand why this would happen with default configuration and why elasticsearch wouldnt allocate to other instances despite the high utilization on the dense storage nodes.
Could this be that no policies are applied to templates to set which node types to use?