Limit elasticsearch indexes in size and rollover when the limit is reached

Question

I've a docker container running elasticsearch and recently I've got into a situation when the container stopped because it ran out of space. Now I have no ability to start (it stops immediately) it and cleanup the disk.

I know I can write logs into different indexes (and I'm already doing that) on some time basis (daily) and then clean them, but even with this approach I can get into situation when my container generates so many logs so it can run out of space before my cleanup job starts and will be broken.

• How can I prevent this situation with elasticsearch in future, just to make sure my indexes take no more than limit I defined?
• Is there a better way to manage disk space taken by elasticsearch logs?

Answer 1

You can't have size limits. Elasticsearch is not fixed-size db like Whisper. Try to optimize your indexed data or mapping to reduce index size, or create/clean new indices hourly.