while debugging elasticsearch/logstash today I noticed logstash100[456] carry a very large / which we can use instead for more disk space for elasticsearch
logstash1004:~$ df -hT Filesystem Type Size Used Avail Use% Mounted on /dev/md0 ext3 235G 1.8G 221G 1% / udev devtmpfs 10M 0 10M 0% /dev tmpfs tmpfs 26G 473M 25G 2% /run tmpfs tmpfs 64G 0 64G 0% /dev/shm tmpfs tmpfs 5.0M 0 5.0M 0% /run/lock tmpfs tmpfs 64G 0 64G 0% /sys/fs/cgroup /dev/md1 xfs 2.8T 1.6T 1.2T 57% /var/lib/elasticsearch
root can be ~40-50G max if no separate /var is used, meaning ~185G * 4 = 750G more for elasticsearch