cannot log into kibana

[cisspUser01]

Kibana wont let me log in because of low disk space. I have to keep increasing the vdisk. Im trying to edit one of the Index Lifecycle Policies that is managed by the system called .alerts-ilm-policy. when I go inside that policy, it stated editing a manage policy can break kibana. but I believe this one is causing the space issue. can I edit this policy without breaking Kibana?

thank you,

[aarz-snl]

You can edit the policy or copy it and make a new one with it and then apply it.

[aarz-snl]

the warning is overly cautious

if you must edit things to keep your size down, then do not fear doing so.

[aarz-snl]

but thanks for the information... it looks like we need to add documentation on specifically managing this index too?

[cisspUser01]

Thank you. From: Andrew Arz ***@***.***> Sent: Thursday, March 6, 2025 3:26 PM To: cisagov/LME ***@***.***> Cc: Chenh Hong ***@***.***>; Author ***@***.***> Subject: Re: [cisagov/LME] cannot log into kibana (Discussion #606) Glantz External Email Warning: Thoroughly review all content of this email before responding, clicking on any links, or opening any attachments. If anything looks strange please delete the email and contact Glantz IT but thanks for the information... it looks like we need to add documentation on specifically managing this index too? — Reply to this email directly, view it on GitHub<#606 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BPUNJIHGZVDT6FTTMXGVCP32TCVMTAVCNFSM6AAAAABYMQBREOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENBRHA2TQMA>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>> Chenh Hong Network/Security Manager Glantz 2501 Constant Comment Place Louisville, KY 40299 Tel: 502.568.4429 [https://s3.amazonaws.com/glantz/glantz/content/website/3.324eSig.jpg]<https://www.nglantz.com/search?searchString=Wieland&facets=fg_brand%7Cfg_brand_Wieland&from=1&trk=CMP-103182> Shop at Glantz<https://www.nglantz.com> [https://s3.amazonaws.com/glantz/glantz/content/website/facebook-colorful-logo.png]<https://www.facebook.com/GlantzSignSupplies/> [https://s3.amazonaws.com/glantz/glantz/content/website/instagram-colorful-logo.png] <https://www.instagram.com/glantzsignsupplies/> [https://s3.amazonaws.com/glantz/glantz/content/website/linkedin-colorful-logo.png] <https://www.linkedin.com/company/1303642?trk=tyah&trkInfo=tarId%3A1410786353426%2Ctas%3An%20gl%2Cidx%3A2-2-7> [https://s3.amazonaws.com/glantz/glantz/content/website/youtube-colorful-logo.png] ***@***.***> Disclaimer posted by 766HGC3dXXQ167

[aarz-snl]

take a look at the steps for wazuh index managmenet -- may be able to use some of that like grabbing the current ocnfig:

GET _ilm/policy/.alerts-ilm-policy

Adjusting -- this is just an example you dont have to use this or anything make it yours

PUT _ilm/policy/.alerts-ilm-policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_primary_shard_size": "5gb",
            "max_age": "1d"
          },
          "set_priority": {
            "priority": 100
          }
        }
      },
      "warm": {
        "min_age": "2d",
        "actions": {
          "set_priority": {
            "priority": 50
          },
          "shrink": {
            "number_of_shards": 1
          },
          "forcemerge": {
            "max_num_segments": 1
          }
        }
      },
      "cold": {
        "min_age": "5d",
        "actions": {
          "set_priority": {
            "priority": 0
          }
        }
      },
      "delete": {
        "min_age": "7d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": true
          }
        }
      }
    }
  }
}

[cisspUser01]

thank you, I have edited the policy.