---
title: Disk watermark low
description: Describes what AutoOps detects and surfaces with the Disk watermark low insight: Disk usage on one or more nodes has crossed the low watermark.
url: https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch/disk_watermark_low
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud on Kubernetes
  - Elasticsearch
applies_to:
  - Elastic Cloud Hosted: Generally available
  - Elastic Cloud on Kubernetes: Generally available
  - Elastic Cloud Enterprise: Generally available
  - Self-managed Elastic deployments: Generally available
---

# Disk watermark low
Disk usage on one or more nodes has crossed the low watermark. Elasticsearch stops placing new shards on those nodes; shards already present continue to accept writes, so usage might keep rising.
<note>
  For a complete list of insights, refer to [AutoOps insights](https://docs-v3-preview.elastic.dev/elastic/autoops-insights/tree/main/elasticsearch).
</note>


## Insight details


| Field     | Value                                   |
|-----------|-----------------------------------------|
| Component | Elasticsearch                           |
| Severity  | Medium                                  |
| Scope     | Node                                    |
| Domains   | cluster-health, disk-storage, stability |


## Customization settings

You can customize these settings to adjust when AutoOps detects this event and presents the insight. Refer to [AutoOps event settings](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/monitor/autoops/ec-autoops-event-settings) for details.
The default customization settings are:

| Setting                                       | Type       | Default |
|-----------------------------------------------|------------|---------|
| Early warning margin before the low watermark | Percentage | 0       |


## Example: What you might see in AutoOps

The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.

### The low disk watermark has been exceeded on: `es-data-01` (hot, warm)


#### What was detected

The low disk watermark has been exceeded by 12 GB.
Affected nodes: `es-data-01` and `es-data-02`.
Affected tier(s): hot, warm.
Remaining space before the high watermark: 48 GB.
Largest indices on the affected node(s): `logs-prod-000045`.

#### Recommendations

<note>
  AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
</note>

<dropdown title="Increase disk size">
  **Condition**: Shown when always included when disk watermark is crossed on a data node; on hot nodes this is ingest risk, on warm/cold nodes this is retention risk.Increase disk size on the affected node (current capacity: 500 GB).
</dropdown>

<dropdown title="Temporary disk watermark increase">
  **Condition**: Shown when available disk space > 100GB.Temporarily raise the disk watermark so you can free space before the cluster restricts shard allocation. After you reclaim disk, return the watermark to its previous value. Use the action below to update `cluster.routing.allocation.disk.watermark.high`.
  ```json

  {
    "transient": {
      "cluster.routing.allocation.disk.watermark.high": "90%"
    }
  }
  ```

  <note>
    Requires the `manage cluster` privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
  </note>
</dropdown>

<dropdown title="Move shard to less loaded node">
  **Condition**: Shown when other data nodes (preferably in the same tier) have spare space.Move shard 0 of logs-prod-000045 from es-data-01 to es-data-02 with the action below to rebalance disk use.
  ```json

  {
    "commands": [
      {
        "move": {
          "index": "logs-prod-000045",
          "shard": 0,
          "from_node": "es-data-01",
          "to_node": "es-data-02"
        }
      }
    ]
  }
  ```

  <note>
    Requires the `manage cluster` privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
  </note>
</dropdown>

<dropdown title="Reduce shard replicas">
  **Condition**: Shown when number of replicas > 1.Reduce replica count on logs-prod-000045 from 1 to 2 to free disk space. Start with indices that have more than two shard copies.
  ```json

  {
    "index": {
      "number_of_replicas": 2
    }
  }
  ```

  <note>
    Requires the `manage` index privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
  </note>
</dropdown>

<dropdown title="Force merge deleted documents">
  **Condition**: Shown when old read-only indices exist on affected data node (particularly warm/cold tier).Run a force merge with `only_expunge_deletes=true` on `logs-prod-000045`, `logs-prod-000046` to reclaim disk used by deleted documents. Use the action below.
  ```json
  ```

  <note>
    Requires the `manage cluster` privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
  </note>
</dropdown>

<dropdown title="Delete old data">
  **Condition**: Shown when "old" index exists; warm/cold tier: consider retention policies and ILM.Delete unused or old indices to free disk space. Snapshot indices first if you might need them later. Use the action below to remove logs-archive-000001.
  ```json
  ```

  <note>
    Requires the `manage cluster` privilege. Requires Elasticsearch 8.0.0 or later. This action changes cluster or index configuration.
  </note>
</dropdown>


#### Background and impact

Elasticsearch manages disk pressure with three watermark levels. The low watermark is the first threshold. When it is crossed, the master node stops assigning new shards to the affected nodes. Existing shards stay in place and continue to accept writes, so disk usage can keep climbing. If no other nodes have room to accept shards, new primaries or replicas cannot be placed and the cluster can turn yellow or red. Tier context matters here: hot-tier pressure affects active ingest; warm or cold nodes carry retention data where ILM moves are an option. Address capacity before the high watermark is reached: expand disk, apply ILM or delete policies, reroute shards to nodes with headroom, or temporarily raise the watermark if you have sufficient free space.

### Guide

[Fix watermark errors](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/troubleshoot/elasticsearch/fix-watermark-errors)