Before you begin reading the explanation below, try running the free ES Health Check-Up get actionable recommendations that can improve Elasticsearch performance and prevent serious incidents. Just 2 minutes to complete and you can check your threadpools, memory, snapshots and many more
Disk watermarks in Elasticsearch
Elasticsearch considers the available disk space before deciding whether to allocate new shards, relocate shards away or put all indices on read mode based on a different threshold of this error. The reason is Elasticsearch indices consists of different shards which are persisted on data nodes and low disk space can cause issues.
Relevant settings related
cluster.routing.allocation.disk.watermark and have three thresholds of low, high, and flood_stage and can be changed dynamically as well. It Accepts absolute as well as percentage values. More information available on official ES doc.
How to fix logs messages related to Disk watermarks
Permanent fixes:
a) Delete unused indices.
b) Merge segments to reduce the size of the shard on the affected node, more info on opster’s Elasticsearch expert’s STOF answer
c) Attach external disk or increase the disk used by the data node
Temp hack/fixes:
a) Changed these settings values to a higher threshold by dynamically update settings using below update cluster API.
PUT _cluster/settings :
{
“transient”: {
“cluster.routing.allocation.disk.watermark.low”: “100gb”, –>adjust according to your situations
“cluster.routing.allocation.disk.watermark.high”: “50gb”,
“cluster.routing.allocation.disk.watermark.flood_stage”: “10gb”,
“cluster.info.update.interval”: “1m”
}
}
b) Disable disk check by hitting below cluster update API
{
“transient”: {
“cluster.routing.allocation.disk.threshold_enabled” : false
}
}
Even After all these fixes, Elasticsearch won’t bring indices in write mode for that this API needs to be activated
PUT _all/_settings
{
“index.blocks.read_only_allow_delete”: null
}
About Opster
Opster detects, prevents, optimizes and automates everything needed to run mission-critical Elasticsearch
