Attention Filebeat Users

Elasticsearch Disk Issues Can Cause Invisible Root (/) Disk Exhaustion on Filebeat Hosts

This document describes a real-world failure scenario in environments using Filebeat and Elasticsearch, where a problem that starts on the Elasticsearch side can silently propagate and result in root filesystem (/) exhaustion and potential access loss on Filebeat hosts.

This is not a theoretical edge case.
It is an operational risk that must be understood and monitored.

Where Does the Incident Start?

In many environments, Elasticsearch disk usage is treated as an isolated Elasticsearch concern.
In practice, this assumption is dangerous.

Risk scenarios include:

• Elasticsearch disk (or PVC) reaching critical capacity
• Indices being automatically set to read-only
• Bulk ingest requests slowing down or failing
• Backpressure in the ingest pipeline

When this happens:

• Elasticsearch cannot accept new writes reliably
• Filebeat does not stop
• Filebeat continues reading log files and retrying delivery

Result:

The problem starts in Elasticsearch but materializes on the Filebeat host.