Elasticsearch cluster.routing.allocation.disk.watermark.low: 85% Default Explained

Q: What is the fastest way to diagnose a node crossing the 85% low disk watermark in production?

Run GET /_cat/allocation?v and look at the disk.percent column for the offending node, then check whether new-index allocation has begun to skew toward less-full nodes. For continuous coverage, Pulse acts as an AI DBA for Elasticsearch and OpenSearch that watches the 85% threshold per node, projects fill rate, and recommends ILM, rollover, or capacity changes before the 90% high watermark forces shard relocation.

Q: What is the default for cluster.routing.allocation.disk.watermark.low in Elasticsearch?

The default is 85%, meaning Elasticsearch stops allocating new shards to a node once that node's disk is more than 85% full. The value can be expressed as a percentage or as an absolute amount of free disk space.

Q: What happens when a node crosses the low watermark?

Elasticsearch stops placing newly allocated shards (from new indices) onto that node. Existing shards stay put, and the node can still receive shards as the target of a rebalance. Writes to existing indices on the node continue normally.

Q: How is the low watermark different from the high watermark?

The low watermark (default 85%) only blocks new-shard allocation. The high watermark (default 90%) goes further and actively relocates existing shards away from the node. Flood stage (default 95%) blocks writes by forcing indices read-only.

Q: Can I change cluster.routing.allocation.disk.watermark.low without restarting?

Yes. It is a dynamic cluster setting. Update through PUT /_cluster/settings and the new value takes effect at the next disk-usage check (every 30 seconds by default).

Q: Should I use a percentage or absolute value for the low watermark?

Use percentages on homogeneous clusters (identical disk sizes). Use absolute free-space values on heterogeneous clusters or very large disks - on a 10 TB volume, the 15% gap between 85% and 100% is 1.5 TB, which is a lot of headroom you may not need.

Q: How often does Elasticsearch check disk usage against the watermark?

Every cluster.info.update.interval , which defaults to 30 seconds. The check is performed by the master, and the threshold decisions are taken centrally.

The cluster.routing.allocation.disk.watermark.low setting is the first of Elasticsearch's three disk watermark thresholds. It defaults to 85% of disk usage. Once a data node's disk usage crosses this watermark, Elasticsearch stops placing newly created shards on that node, though it will still allow shards to move there as part of a rebalance. The low watermark is the cluster's early-warning signal: it does not block writes, but it is the moment to start adding capacity or pruning data, because the high watermark at 90% and flood stage at 95% trigger more disruptive responses.

Definition

cluster.routing.allocation.disk.watermark.low is a dynamic cluster-level setting expressed as either a percentage of total disk space or an absolute size of free space remaining. It controls only one decision: whether a node is eligible to receive newly allocated primary or replica shards for new indices. Existing shards stay put. The check runs every cluster.info.update.interval (default 30 seconds).

Default and Allowed Values

Property	Value
Default	`85%`
Type	Percentage (`85%`) or absolute free space (`200gb`, `1tb`)
Scope	Cluster, dynamic
Effect	Blocks new shard allocation to over-watermark nodes; existing shards unaffected
Companion settings	`disk.watermark.high` (90%), `disk.watermark.flood_stage` (95%)

The percentage form is the disk-used percentage, not free. 85% means "act when more than 85% of disk is used". The absolute form is free space, so 200gb means "act when less than 200 GB is free".

How to Change It

Through the cluster settings API:

# Lower the low watermark to 80% (act sooner)
PUT /_cluster/settings
{
  "persistent": {
    "cluster.routing.allocation.disk.watermark.low": "80%"
  }
}

Or with an absolute free-space value, which is more predictable on clusters with mixed disk sizes:

PUT /_cluster/settings
{
  "persistent": {
    "cluster.routing.allocation.disk.watermark.low": "500gb"
  }
}

Reset to default by setting to null. You can also configure all three watermarks in elasticsearch.yml for static deployment, but the dynamic API is preferred so values can be tuned without restarts.

Important: the three watermark values must obey low <= high <= flood_stage. Elasticsearch rejects updates that break the ordering or that mix percentages with absolute values inconsistently across the three.

Operational Impact

When a node crosses the low watermark:

New indices created from that point on will not place any shard on the affected node.
Existing shards remain where they are.
Rebalancing can still move shards onto the node if it is the best target.
The node logs high disk watermark warnings? No - the low watermark logs at INFO level. High watermark (90%) is the one that logs warnings.

If every node in the cluster crosses the low watermark simultaneously, new indices are still allocated, but Elasticsearch picks whichever node has the most free space. Yellow or red cluster status can follow if there is genuinely no space for the required replicas.

Common Mistakes

Treating percentages and absolute values as interchangeable. Percentages scale with disk size; absolute values do not. Pick one and use it consistently across the three watermarks.
Setting low and high too close together. Leaving only 1-2% between them gives the cluster no time to react before the high watermark kicks in and forces shard relocations.
Raising the low watermark to silence warnings. That just delays the inevitable. Address the underlying capacity issue.
Forgetting that the threshold uses used space, not free. 85% means full, not empty. Wrong direction is a common bug in alerting wrappers.

Catch the 85% Low Watermark Before It Cascades to High Watermark with Pulse

Pulse is an AI DBA for Elasticsearch and OpenSearch. The 85% low watermark is the cluster's earliest signal that disk capacity is becoming a problem - by the time the high watermark at 90% and flood stage at 95% fire, mitigation is far more disruptive. When a data node crosses cluster.routing.allocation.disk.watermark.low (default 85%) in your environment, Pulse:

Continuously tracks per-node disk.percent from _cat/allocation and projects disk-fill rate against the configured watermark
Correlates the watermark trip with new-index allocation behaviour, ILM rollover state, snapshot retention, and cluster.info.update.interval cadence
Identifies why the node is filling - missing ILM delete phase, oversharded daily indices, an upstream pipeline backfill, or unbalanced shard placement
Recommends the precise fix - trigger rollover, expand ILM coverage, add a data node, switch to absolute free-space form (200gb) on heterogeneous clusters, or rebalance shards to under-utilised nodes
Applies low-risk fixes automatically with your approval (deleting indices past their retention) or generates a one-click ILM/template PR before the next 5% of disk consumption forces shard relocation

Pulse turns the 85% warning into an agentic SRE workflow that buys time before the high watermark forces shard relocation. Start a free trial.

Frequently Asked Questions

Q: What is the fastest way to diagnose a node crossing the 85% low disk watermark in production?
A: Run GET /_cat/allocation?v and look at the disk.percent column for the offending node, then check whether new-index allocation has begun to skew toward less-full nodes. For continuous coverage, Pulse acts as an AI DBA for Elasticsearch and OpenSearch that watches the 85% threshold per node, projects fill rate, and recommends ILM, rollover, or capacity changes before the 90% high watermark forces shard relocation.

Q: What is the default for cluster.routing.allocation.disk.watermark.low in Elasticsearch?
A: The default is 85%, meaning Elasticsearch stops allocating new shards to a node once that node's disk is more than 85% full. The value can be expressed as a percentage or as an absolute amount of free disk space.

Q: What happens when a node crosses the low watermark?
A: Elasticsearch stops placing newly allocated shards (from new indices) onto that node. Existing shards stay put, and the node can still receive shards as the target of a rebalance. Writes to existing indices on the node continue normally.

Q: How is the low watermark different from the high watermark?
A: The low watermark (default 85%) only blocks new-shard allocation. The high watermark (default 90%) goes further and actively relocates existing shards away from the node. Flood stage (default 95%) blocks writes by forcing indices read-only.

Q: Can I change cluster.routing.allocation.disk.watermark.low without restarting?
A: Yes. It is a dynamic cluster setting. Update through PUT /_cluster/settings and the new value takes effect at the next disk-usage check (every 30 seconds by default).

Q: Should I use a percentage or absolute value for the low watermark?
A: Use percentages on homogeneous clusters (identical disk sizes). Use absolute free-space values on heterogeneous clusters or very large disks - on a 10 TB volume, the 15% gap between 85% and 100% is 1.5 TB, which is a lot of headroom you may not need.

Q: How often does Elasticsearch check disk usage against the watermark?
A: Every cluster.info.update.interval, which defaults to 30 seconds. The check is performed by the master, and the threshold decisions are taken centrally.