Elasticsearch Disk Underutilization on Cold Tier in Elasticsearch

By Opster Team

Updated: Mar 10, 2024

| 2 min read

What does this mean?

If there is more disk space allocated to cold nodes in the Elasticsearch cluster than needed, this means that the disk resources are not being used efficiently, and there is potential to reduce costs by optimizing disk utilization.

Why does this occur?

This can occur due to various reasons, such as:

  1. Overestimation of storage requirements during the initial setup of the cluster.
  2. Decrease in data volume over time, leading to unused disk space.
  3. Inefficient data management practices, such as deleting old or unnecessary data without revising storage requirements.

Possible impact and consequence of low disk utilization 

The possible consequences of this include:

  1. Increased costs: Over-allocating disk space can lead to higher infrastructure costs, as you are paying for resources that are not being used effectively, not only storage-wise., but if the provisioned data storage resulted from a specific memory-to-disk ratio, you might also be paying for too much RAM.
  2. Suboptimal performance: Underutilized disk space can result in inefficient data storage and retrieval, which can negatively impact the performance of your Elasticsearch cluster.

How to resolve

To resolve the issue of disk underutilization on the cold tier, you can take the following steps:

  1. Move to smaller disk capacity: By moving to smaller disks, you can reduce the amount of unused disk space and optimize disk utilization. This can be done by resizing the existing disks or replacing them with smaller ones.
  1. Reduce the number of cold data nodes: Reducing the number of cold data nodes can help you optimize disk utilization by distributing data more evenly across the available cold nodes. This can also help you save money and improve the performance of your Elasticsearch cluster.

Command example to drain data to other cold nodes so that the specified cold node can be deprovisioned:

PUT /_cluster/settings
  "transient": {
    "cluster.routing.allocation.exclude._ip": ""
  1. Optimize data lifecycle management: Implementing proper data lifecycle management policies, such as using Index Lifecycle Management (ILM) in Elasticsearch, can help in optimizing disk utilization. By defining appropriate policies for data rollover, shrinking, and deletion, you can ensure that the disk space is used efficiently.


By following the steps mentioned in this guide, you can resolve the issue of disk underutilization on the cold tier in Elasticsearch. This will help you optimize disk utilization, reduce operational costs, and improve the overall efficiency of your Elasticsearch deployment.