# I don't have Elasticsearch installed but I'm getting a watermark error **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** elastic, data-node\ **Created:** [December 23, 2024, 12:07pm UTC](https://community.graylog.org/t/i-dont-have-elasticsearch-installed-but-im-getting-a-watermark-error/34513 "2024-12-23T12:07:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Treshkin](https://avatars.discourse-cdn.com/v4/letter/t/c5a1d2/32.png) [@Treshkin](https://community.graylog.org/u/Treshkin)\ **Post date:** [December 23, 2024, 12:07pm UTC](https://community.graylog.org/t/i-dont-have-elasticsearch-installed-but-im-getting-a-watermark-error/34513/1 "2024-12-23T12:07:43Z")
I have received this warning, but I am not even using or installing elasticsearch. “Elasticsearch nodes disk usage above low watermark (triggered 19 minutes ago) There are Elasticsearch nodes in the cluster running out of disk space, their disk usage is above the low watermark. For this reason Elasticsearch will not allocate new shards to the affected nodes. The affected nodes are: [127.0.1.1] Check [Disk-based shard allocation | Elasticsearch Guide [master] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/disk-allocator.html) for more details.” ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/5/c/5cf6db9f9d33ed9b691954e871a3702d938dd509.png) Ubuntu 22.04.5 Graylog version is _6.1.2_ Please does anyone know where this notice comes from? Thanks. ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [December 23, 2024, 12:48pm UTC](https://community.graylog.org/t/i-dont-have-elasticsearch-installed-but-im-getting-a-watermark-error/34513/2 "2024-12-23T12:48:52Z")
It uses the word elastic of all backend storage. So in your case its saying that your datanode machine is running out of storage, what does the storage usage look like on that machine? ---
**Author:** ![Treshkin](https://avatars.discourse-cdn.com/v4/letter/t/c5a1d2/32.png) [@Treshkin](https://community.graylog.org/u/Treshkin)\ **Post date:** [December 23, 2024, 3:12pm UTC](https://community.graylog.org/t/i-dont-have-elasticsearch-installed-but-im-getting-a-watermark-error/34513/3 "2024-12-23T15:12:35Z")
Thank you. This graylog is a test log and has a 50GB disk. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/e/2/e2efce483cc17932c43b8a7d772639544a48bb09.png) /dev/mapper/ubuntu–vg-ubuntu–lv 29G 14G 13G 52% ---
**Author:** ![Tdvorak](https://avatars.discourse-cdn.com/v4/letter/t/a88e57/32.png) [@Tdvorak](https://community.graylog.org/u/Tdvorak)\ **Post date:** [December 27, 2024, 5:53am UTC](https://community.graylog.org/t/i-dont-have-elasticsearch-installed-but-im-getting-a-watermark-error/34513/4 "2024-12-27T05:53:42Z")
Hi @Treshkin, You have only 13G available there. Whole 10G will be consumed by the opensearch snapshots cache. If you aren’t using [searchable snapshots / warm tier](https://go2docs.graylog.org/current/setting_up_graylog/data_tiering.htm), you can limit the size of the cache by the following setting in your datanode: ```auto node_search_cache_size=1gb ``` If you’ll update to the latest [datanode 6.1.4](https://go2docs.graylog.org/current/changelogs/changelog.html?tocpath=Changelogs%7C _____ 1#Graylog614), the problem will be fixed automatically. Datanode detects if the cache is needed and disables it automatically. Best regards, Tomas ---
**Author:** ![Treshkin](https://avatars.discourse-cdn.com/v4/letter/t/c5a1d2/32.png) [@Treshkin](https://community.graylog.org/u/Treshkin)\ **Post date:** [December 27, 2024, 11:12am UTC](https://community.graylog.org/t/i-dont-have-elasticsearch-installed-but-im-getting-a-watermark-error/34513/5 "2024-12-27T11:12:06Z")
Thanks @Joel_Duffield and @Tdvorak ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 10, 2025, 11:12am UTC](https://community.graylog.org/t/i-dont-have-elasticsearch-installed-but-im-getting-a-watermark-error/34513/6 "2025-01-10T11:12:20Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.