Bug 1956882

Summary: Elasticsearch storage is not released after removing indices
Product: OpenShift Container Platform Reporter: Gianluca Villani <gvillani>
Component: LoggingAssignee: Periklis Tsirakidis <periklis>
Status: CLOSED NOTABUG QA Contact: Anping Li <anli>
Severity: high Docs Contact:
Priority: unspecified    
Version: 4.6CC: aos-bugs, gianluca.villani, ikarpukh, periklis
Target Milestone: ---Flags: gvillani: needinfo+
gvillani: needinfo+
gvillani: needinfo+
Target Release: 4.6.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: logging-exploration
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-05-20 14:17:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Comment 1 Periklis Tsirakidis 2021-05-20 14:17:29 UTC 
@gvillani@redhat.com 

This is not really a bug in the behavior of Elasticsearch. I recommend to take a look on this troubleshooting guide we have compiled about deleting documents from indices [1].

TL;DR; If you delete documents from ES indices this does not immediately result in deleting them from the PVC storage. Garbage collecting is happening asynchronously in Elasticsearch. There is a _forcemerge call to do this manually but it is an expensive call AFAIK.

[1] https://github.com/openshift/elasticsearch-operator/blob/master/docs/troubleshooting.md#delete-logs-for-specific-namespace