Elasticsearch Diskspace

Elasticsearch 2.x installed on Centos 7.3

By default Centos 7 will allocate the majority of disk space to /home. Unfortunately, this is not where Elasticsearch is storing data by default.

Run df -h to take a look at your partitioning.

2017-03-04 08_56_01-Admin Console

If in Graylog you receive a journaling error this could be the reason.

This is because it can no longer get data into the Elasticseach cluster.

Your temp directory will fill up with Graylog trying to preserve data as /tmpfs is where Graylog stores journals.

To prevent this from happening you will need to change the Path in the elasticsearch.yml

Elasticsearch path.data is where the majority of your storage needs to be allocated.

By default, this is located in

/var/lib/elasticsearch

Below is an example of what I have on my Elasticsearch cluster nodes.

2017-02-26-11_54_37-Admin-Console

If you have already filled up your disk space you have some cleanup to do. as your

To fix this move your Elasticsearch data by doing this.

  1. sudo service elasticsearch stop
  2. mkdir /home/elasticsearch/data
  3. cp /var/lib/elasticsearch / /home/elasticsearch/data
  4. sudo service elasticsearch start

I chose to move my logs as well but that is just preference since they don’t take up much space.

If errors continue you will need to stop the cluster again and delete the indices and shards to get things running again.  You will lose data if you need to delete obviously.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Powered by WordPress.com.

Up ↑

%d bloggers like this: