Index auto delete cause of reached watermark

[GyciakasGh0st]

I few of our index was deleted due to reach watermark:
[2025-04-29T04:53:04,969][INFO ][org.elasticsearch.cluster.routing.allocation.DiskThresholdMonitor] high disk watermark [85%] exceeded on [RwEVevN_QfahOu5QxbtGwg][manager-soc][/usr/share/elasticsearch/data] free: 38.9gb[11.9%], shards will be relocated away from this node; currently relocating away shards totalling [13373365261] bytes; the node is expected to be below the high disk watermark when these relocations are complete
[2025-04-29T04:55:02,798][INFO ][org.elasticsearch.datastreams.action.DeleteDataStreamTransportAction] removing data stream [logs-endpoint.events.process-baltnetoskomunikacijos]
[2025-04-29T04:55:02,800][INFO ][org.elasticsearch.cluster.metadata.MetadataDeleteIndexService] [.ds-logs-endpoint.events.process-baltnetoskomunikacijos-2025.04.22-000001/HjRE4TnWTiqNnuOGAv5eBw] deleting index

It is possible somewhere to set that it watermark is hit i wouldn't auto delete indexses ?

[cm-ops]

https://docs.securityonion.net/en/2.4/elasticsearch.html#index-management turn off the delete script.

You will have to manage with Elastic ILM to keep from hitting watermark settings.

[GyciakasGh0st]

And it would be wise to remove data role from manager node ? we have 4 separate data nodes(search nodes)

[cm-ops]

If your manager node's disk space is much lower than the search nodes you could remove the data role and have a cluster with 4 data nodes.

You can also use data tiers and select certain data only, for example, non-time series data (data_content tier) so only those indices are on the manager.