unable to free space

[capitangiaco]

Hi I am trying Security Onion 2.4.60 (distributed deployment)
After reaching the deploy of 300 elastic agents on windows clients (too much windows metrics with default settings) I have troubles with the /nsm free space.

I tried to lower the ES logs retention, but:

[root@securityonion1 ~]# tail -f /opt/so/log/elasticsearch/indices-delete-alert.log
Tue May 21 05:30:09 PM UTC 2024,2a2ab54c-19d5-4538-ab8a-d1b0f296990e,Maximum iteration limit reached (10). Unable to bring disk below threshold.

Can I manually delete oldest data ?

thanks
Giacomo

[reyesj2]

You may be able to delete your oldest data using so-elasticsearch-query

https://docs.securityonion.net/en/2.4/so-elasticsearch-query.html#examples