How to prevent the elasticsearch from eating up all the disk space

[Yu Kou (ckyoog)]

Looks like the indices are associated with each other, and used for different purpose, such as internal object, meta data, stix domain, operation history. I reckon that the indices for operation history can be deleted, but I'm not 100% sure. For other indices, I really don't think it is free for me to delete, like the indices for the internal object, which is most likely to retain the running state. So, if the indices can't be deleted, how can I restrict the elasticsearch from eating up all the disk space.

[Julien Richard (richard-julien)]

You need to use retention policies that will delete stuff older than XXX. You can find the screen at /dashboard/settings/retention