Have a look at: https://www.elastic.co/guide/en/elasticsearch/reference/1.6/index-modules-allocation.html
You might be able to achieve the rebalancing by setting cluster.routing.allocation.disk.watermark.high to eg 66% in elasticsearch.yml. This should offload shards to other nodes until your disk space is <= 66% allocated. Once enabled, Elasticsearch uses two watermarks to decide whether shards should be allocated or can remain on the node. cluster.routing.allocation.disk.watermark.low controls the low watermark for disk usage. It defaults to 85%, meaning ES will not allocate new shards to nodes once they have more than 85% disk used. It can also be set to an absolute byte value (like 500mb) to prevent ES from allocating shards if less than the configured amount of space is available. cluster.routing.allocation.disk.watermark.high controls the high watermark. It defaults to 90%, meaning ES will attempt to relocate shards to another node if the node disk usage rises above 90%. It can also be set to an absolute byte value (similar to the low watermark) to relocate shards once less than the configured amount of space is available on the node. Regards Marcel -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/968816e5-ac21-4ba4-b073-41e2cd6629de%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
