0

I delete ElasticSearch(elasticsearch-7.2.0) document using:

curl -H'Content-Type:application/json' -d'{
    "query": {
        "range": {
            "@timestamp": {
                "lt": "now-40d",
                "format": "epoch_millis"
            }
        }
    }
}
' -XPOST "http://127.0.0.1:9200/*-*/_delete_by_query?pretty"

this is the result:

{
  "took" : 55500,
  "timed_out" : false,
  "total" : 16710000,
  "deleted" : 16710000,
  "batches" : 20000,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : [ ]
}

but when I check the disk usage:

du -sh /data/docker/efk/elasticsearch-7.2.0/data/nodes/0

the disk space did not released.What should I do to make disk space release?

1 Answer 1

3

elastic just mark documents as deleted and will free it when a merge process happen.

You can use forecemerge API for freeing the disk. https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-forcemerge.html

but you should consider that when you use this command automatic merge and automatic freeing the disk will be disabled for that index.

there is sample command that can solve your problem:

curl  -H'Content-Type:application/json' -XPOST 127.0.0.1:9200/AN-INDEX-NAME/_forcemerge?max_num_segments=1

the merge process is resource killer and you should do it against indices one per time.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.