Yep I been there, you have a couple choices.
1.Expand the volume on the Graylog server.
2.Delete old indices on the Web UI.
3.Since Graylog is unable to start Removed old Indices through CURL just enough to start Graylog then remove/edit the indices on the Web UI ( which is preferred)
Check the size of directory’s. Used this first because I found a large log file and all I had to do was delete it and start Graylog service.
root# du --max-depth=5 /* | sort -rn | more
What I have done was…
Find old indices
curl -X GET "192.168.1.100:9200/_cat/indices?pretty"