# What happens when warm tier gets filled up?

**URL:** <https://discuss.elastic.co/t/what-happens-when-warm-tier-gets-filled-up/321975>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [December 26, 2022, 8:04am UTC](https://discuss.elastic.co/t/what-happens-when-warm-tier-gets-filled-up/321975 "2022-12-26T08:04:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![darshan\_folane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darshan_folane/32/101403_2.png) [@darshan\_folane](https://discuss.elastic.co/u/darshan_folane)\
**Post date:** [December 26, 2022, 8:04am UTC](https://discuss.elastic.co/t/what-happens-when-warm-tier-gets-filled-up/321975/1 "2022-12-26T08:04:06Z")

</div>

Currently, I'm having three warm nodes, and ILM continuously ingesting data in warm nodes. Warm nodes is holding 85%, 80%, and 86% of the data, and data is continuously ingested.  
So what happens when the warm tier gets filled up?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 26, 2022, 12:20pm UTC](https://discuss.elastic.co/t/what-happens-when-warm-tier-gets-filled-up/321975/2 "2022-12-26T12:20:25Z")

</div>

Elasticsearch has three disk-based watermark:

- low watermark, per default 85% of disk usage
- high watermarke, per default 90% of disk usage
- flood watermark, per default 95% of disk usage

When you hit the low watermark threshold, Elasticsearch will stop allocation new replica shards in the new nodes, new primary shards will still be created, but no replicas will be allocated in this node.

When you hit the high watermark threshold, Elasticsearch will try to relocate shards away from the node, sending them to other nodes, this applies to old and new shards.

And when you hit the flood stage watermark, Elasticsearch will set every index that has a shard on the node as read-only to prevente the node to filling up to 100%.

You can read more about these [settings](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-cluster.html#disk-based-shard-allocation) here.

Also, if you have large disks you may need to change those default values to not waste space.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 26, 2022, 12:41pm UTC](https://discuss.elastic.co/t/what-happens-when-warm-tier-gets-filled-up/321975/3 "2022-12-26T12:41:53Z")

</div>

When disk fills up Elsticsearch will stop allocating new shards to the nodes and try to relocate existing ones. This means migration of data from hot nodes can stop and those nodes fill up, in turn resulting in indices going read-only when the disks on the hot nodes fill up. I would recommend monitoring disk space and adjust data retention or cluster size as disks fill up.

---

<div class="post-metadata">

**Author:** ![darshan\_folane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darshan_folane/32/101403_2.png) [@darshan\_folane](https://discuss.elastic.co/u/darshan_folane)\
**Post date:** [December 26, 2022, 5:27pm UTC](https://discuss.elastic.co/t/what-happens-when-warm-tier-gets-filled-up/321975/4 "2022-12-26T17:27:17Z")

</div>

Thanks, @leandrojmp, and @Christian_Dahlqvist.  
It clears the watermark concept.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 23, 2023, 5:27pm UTC](https://discuss.elastic.co/t/what-happens-when-warm-tier-gets-filled-up/321975/5 "2023-01-23T17:27:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
