KnowledgeBase/CII.md

@@ -1877,6 +1877,37 @@ This question was originally asked in [ECII-422](https://jira.eso.org/browse/ECI
 ### [IntCfg]
 
 
+--------------------------------------------------------------------------
+--------------------------------------------------------------------------
+--------------------------------------------------------------------------
+### Elasticsearch disk usage and house-keeping [IntCfg]
+
+The Elasticsearch database is used by many CII services, e.g. to store CII log messages, tracing data, and Oldb metadata. If you run a local elasticsearch database on your host (i.e. you have set up a "role_ownserver" during post-install), it is advisable to do some house-keeping on this database from time to time.
+
+Some house-keeping is automated (e.g. ".monitoring-es" indices are automatically rolled over every few days), others may be automated in the future, but currently are not. Instead you should perform the tasks below at your own discretion.
+
+1. Check which indices you have and how much memory they consume:
+```
+curl localhost:9200/_cat/indices/_all?v\&s=store.size
+```
+
+2. To delete diagnostic indices that are older than X days:
+```
+function ela_purge_idx { name=$1; age=$2;   limit=$(date -d "$age days ago" +"%Y%m%d") ; for a in `curl -s localhost:9200/_aliases | jq -r 'keys | .[]'`  ; do [[ $a == *$name* ]] && [[ "${a//[!0-9]/}" -lt $limit ]] && curl -X DELETE localhost:9200/$a ; done }
+
+ela_purge_idx jaeger 10     # delete *jaeger* indices older than 10 days
+```
+
+3. To delete CII log messages that are older than 30 days:
+```
+curl -X POST "localhost:9200/cii_log_default_index/_delete_by_query?pretty" -H 'Content-Type: application/json' -d' {"query": {"range" : {"@timestamp" : {"lte": "now-30d/d" } } } } '
+```
+
+4. To free your disk from diagnostic logs older than 10 days, do (as root):
+```
+find /var/log/elasticsearch -type f -mtime +10 -delete
+```
+
 
 --------------------------------------------------------------------------
 --------------------------------------------------------------------------