Issue/Introduction
You have received an email from Saviynt regarding emergency cleanup action required on the Elasticsearch service to prevent an outage
Cause
Elasticsearch has accumulated too much data and is approaching disk space exhaustion. This low disk space is causing alerts. Action is needed to prevent components that rely on Elasticsearch from failing.
Resolution
Saviynt support will include a list of indices in the email that are taking over 1GB of data. The indices will be the name of the Analytic control formatted to be all lowercase and to remove any spaces. For example, "Test - ES Size" will become "testessize."
The following are two approaches to fixing the issue. Regardless of which option you take, please change all affected analytic controls to follow the best practices for Analytics health.
Option 1:
You can reply with a list of indices that we can delete from Elasticsearch. This will clear up necessary disk space.
This action will cause all run histories to be deleted.
Option 2:
- Configure all mentioned controls to follow the best practices for Analytics health.
- Run the controls that you modified in step 1.
- Note: This first run of each control will take longer than usual because it will be archiving and deleting old run histories. How long it takes will depend on how many histories there are.
- Reply to Saviynt Support when you have completed this so that support can check the Elasticsearch health.
Please perform this in a lower environment first.
Additional Information
