Elasticsearch Low Disk Watermark

Elasticsearch Low Disk Watermark

Last Update: July 2020

Have you tried our Elasticsearch Check-Up ? (no installation required) get personalized recommendations that can prevent errors and improve your search and indexing speed

What Does it Mean?

There are various “watermark” thresholds on your Elasticsearch cluster.  As the disk fills up on a node, the first threshold to be crossed will be the “low disk watermark”.  Once this threshold is crossed, the Elasticsearch cluster will stop allocating replica shards to that node.  This means that your cluster may become YELLOW.

How to Resolve it

Passing this threshold is a warning and you should not delay in taking action before the higher thresholds are reached. Here are possible actions you can take to resolve the issue:

  • Delete old indices
  • Remove documents from existing indices
  • Increase disk space on the node
  • Add new nodes to the cluster

You can see the settings you have applied with this command:

GET _cluster/settings

If they are not appropriate, you can modify them using a command such as below:

PUT _cluster/settings
{
  "transient": {
   
    "cluster.routing.allocation.disk.watermark.low": "85%",
    "cluster.routing.allocation.disk.watermark.high": "90%",
    "cluster.routing.allocation.disk.watermark.flood_stage": "95%",
    "cluster.info.update.interval": "1m"
  }
}

How to Avoid it

There are various mechanisms to automatically delete stale data.

How to automatically delete stale data:

  1. Apply ILM (Index Lifecycle Management)

    Using ILM you can get Elasticsearch to automatically delete an index when your current index size reaches a given age. 

  2. Use date based indices

    If your application uses date based indices, then it is easy to delete old indices using a script or a tool such as Elasticsearch curator.

  3. Use snapshots to store data offline

    It may be appropriate to store snapshotted data offline and restore it in the event that the archived data needs to be reviewed or studied.

  4. Automate / simplify process to add new data nodes

    Use automation tools such as terraform to automate the addition of new nodes to the cluster.  If this is not possible, at the very least ensure you have a clearly documented process to create new nodes, add TLS certificates and configuration and bring them into the Elasticsearch cluster in a short and predictable time frame.


About Opster

Opster takes a different approach to Elasticsearch operation - Opster pro-actively troubleshoots, optimizes, automates and assists in what's needed to run Elasticsearch smoothly in production.


« Back to Index