# Notifications for disk high watermark despite plenty of disk space

**URL:** <https://community.graylog.org/t/notifications-for-disk-high-watermark-despite-plenty-of-disk-space/20649>\
**Category:** Graylog Central (peer support)\
**Created:** [July 26, 2021, 8:32pm UTC](https://community.graylog.org/t/notifications-for-disk-high-watermark-despite-plenty-of-disk-space/20649 "2021-07-26T20:32:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amclaughlin](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/amclaughlin/32/9151_2.png) [@amclaughlin](https://community.graylog.org/u/amclaughlin)\
**Post date:** [July 26, 2021, 8:32pm UTC](https://community.graylog.org/t/notifications-for-disk-high-watermark-despite-plenty-of-disk-space/20649/1 "2021-07-26T20:32:32Z")

</div>

I’m running Graylog 4.1.1 on an EC2 instance, using AWS ElasticSearch Service for storage. In Graylog, I see a notification for “Elasticsearch nodes disk usage above high watermark” and the subtext includes the line “The affected nodes are: [x.x.x.x, x.x.x.x, x.x.x.x]” (it has the letter “x”, no actual numbers).

I’ve verified that the 8 ES data nodes in my ES cluster have plenty of disk space (at least 175 GB out of 512 GB).

The ES cluster has 3 dedicated master nodes of Instance Type r5.large.elasticsearch. I don’t think I can see the disk usage on the master nodes anywhere in AWS console, but it seems like these are a likely part of the problem.

How can I get Graylog to stop erroneously showing this notification or how can I figure out what the actual problem is?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [July 26, 2021, 10:11pm UTC](https://community.graylog.org/t/notifications-for-disk-high-watermark-despite-plenty-of-disk-space/20649/2 "2021-07-26T22:11:47Z")

</div>

Hello && Welcome

Maybe something in this post might help you.

> [@Elasticsearch nodes disk usage above high watermark](https://community.graylog.org/t/elasticsearch-nodes-disk-usage-above-high-watermark/20367/3):
>
> Hi @ripcentos and Welcome! I have faced this problem a while ago… this is what I did to solve it:

I have found this site informative.

> **[Disk Watermarks In Elasticsearch](https://mincong.io/2021/04/10/disk-watermarks-in-elasticsearch/)**
>
> Understanding different disk watermarks: low, high, and flood-stage in Elasticsearch. The symptom when the cluster reaches these values and how to mitigate or avoid the issues. Also, how to better operate your clusters using these watermarks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 9, 2021, 10:12pm UTC](https://community.graylog.org/t/notifications-for-disk-high-watermark-despite-plenty-of-disk-space/20649/3 "2021-08-09T22:12:04Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
