Bug 1956882

Summary:	Elasticsearch storage is not released after removing indices
Product:	OpenShift Container Platform	Reporter:	Gianluca Villani <gvillani>
Component:	Logging	Assignee:	Periklis Tsirakidis <periklis>
Status:	CLOSED NOTABUG	QA Contact:	Anping Li <anli>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	4.6	CC:	aos-bugs, gianluca.villani, ikarpukh, periklis
Target Milestone:	---	Flags:	gvillani: needinfo+ gvillani: needinfo+ gvillani: needinfo+
Target Release:	4.6.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	logging-exploration
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-20 14:17:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 1 Periklis Tsirakidis 2021-05-20 14:17:29 UTC

@gvillani 

This is not really a bug in the behavior of Elasticsearch. I recommend to take a look on this troubleshooting guide we have compiled about deleting documents from indices [1].

TL;DR; If you delete documents from ES indices this does not immediately result in deleting them from the PVC storage. Garbage collecting is happening asynchronously in Elasticsearch. There is a _forcemerge call to do this manually but it is an expensive call AFAIK.

[1] https://github.com/openshift/elasticsearch-operator/blob/master/docs/troubleshooting.md#delete-logs-for-specific-namespace