ES cluster-space-used script upgrade

[tuamortemo]

Hello,
I am faced with the problem that the ES space is being cleared incorrectly. In my configuration there are 4 nodes with ES (manager and 3 search-node). Each node is identical and has 1.7 TB of nsm. I started watching how the so-elasticsearch-cluster-space-total and spaceused scripts work, which are used in indexes-delete-delete, and noticed that the data is calculated incorrectly, which causes an overflow of the nsm, and es can go into error.
My actual volume is 1.7*4=6.8 TB
cluster-space-total: 8192GB 80%=6553 GB
cluster-space-used: in my situation, it counts 4TB and displays when actually used at 5.1 TB.

Thats how it looks:
Real size:
[root@manager-so adminso]# so-elasticsearch-query _cat/allocation | grep -v "manager-so$" | awk '{print $6}' | grep -oE '[0-9].*'
1.2tb
1.4tb
1.1tb
1.4tb
Total: 5.1

Calculating size:
[root@manager-so adminso]# so-elasticsearch-query _cat/allocation | grep -v "manager-so$" | awk '{print $6}' | grep -oE '[0-9].*' | awk '{print int($1 + 0.5)}'
1
1
1
1
Total:4

so-elasticsearch-indices-delete-delete script should run after 4.5 TB

I tried to adjust the calculation for the so-elasticsearch-cluster-space-used script and that's what I got.

`

for i in $(/usr/sbin/so-elasticsearch-query _cat/allocation | grep -v "manager-so$" | awk '{print $6}'); do

  size=$(echo $i | grep -oE '[0-9][.][0-9]')
  unit=$(echo $i | grep -oE '[A-Za-z]+')
  if [ $unit = "tb" ]; then
    size=$(echo $size 1000000000000 | awk '{print int($1*$2)}')
  elif [ $unit = "gb" ]; then
    size=$(( size * 1000 * 1000 * 1000 ))
  elif [ $unit = "mb" ]; then
    size=$(( size * 1000 * 1000 ))
  elif [ $unit = "kb" ]; then
    size=$(( size * 1000 ))
  elif [ $unit = "b" ]; then
    size=size
    echo "$size"
  fi
  TOTAL_USED_SPACE=$(( TOTAL_USED_SPACE + size ))
done

echo "$TOTAL_USED_SPACE"

`
[root@manager-so adminso]# ./used.sh
1.2
1.4
1.1
1.4
5100000000000

If it makes sense, then for the so-elasticsearch-indexes-delete-delete script to work more correctly, it would be better to edit the space-used operation to a more accurate one, because failures often occur

[TOoSmOotH]

This script is a last resort fail safe and is not intelligent. Tuning ILM is the best answer here. For instance a lot of users don't want to delete suricata alerts but will keep less zeek logs to allow that. The delete script just nukes whatever is the oldest with no concern if it was important to you or not.