That is one way/place to do it, or you can add disk space - I don’t know how much data that represents in relation to the rest of your disk. I also don’t know what you r retention requirements are. Here is a quick search of the Graylog community for Elasticsearch and high watermark. With a little hunting you can find the commands to look at Elasticsearch and clear the read only as well as get a better understanding of what is happening in there. This post has a whole series of commands that will help in general…
Glad to hear you are processing messages again!