I don't have Elasticsearch installed but I'm getting a watermark error

Graylog Central (peer support)
,
1

I have received this warning, but I am not even using or installing elasticsearch.
“Elasticsearch nodes disk usage above low watermark
(triggered 19 minutes ago)
There are Elasticsearch nodes in the cluster running out of disk space, their disk usage is above the low watermark. For this reason Elasticsearch will not allocate new shards to the affected nodes. The affected nodes are: [127.0.1.1] Check Disk-based shard allocation | Elasticsearch Guide [master] | Elastic for more details.”

image
image922×208 7.97 KB

Ubuntu 22.04.5
Graylog version is 6.1.2

Please does anyone know where this notice comes from? Thanks.

2

It uses the word elastic of all backend storage. So in your case its saying that your datanode machine is running out of storage, what does the storage usage look like on that machine?

3

Thank you. This graylog is a test log and has a 50GB disk.

image
image759×168 5.21 KB

/dev/mapper/ubuntu–vg-ubuntu–lv 29G 14G 13G 52%

4

Hi @Treshkin,
You have only 13G available there. Whole 10G will be consumed by the opensearch snapshots cache. If you aren’t using searchable snapshots / warm tier, you can limit the size of the cache by the following setting in your datanode:

node_search_cache_size=1gb

If you’ll update to the latest datanode 6.1.4, the problem will be fixed automatically. Datanode detects if the cache is needed and disables it automatically.

Best regards,
Tomas

5

Thanks @Joel_Duffield and @Tdvorak

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.