Sentinel deletes data from HDFS when the data has reached its retention policy’s time limit. If both Keep at most and Keep at least values are specified, Sentinel deletes data when it has reached its Keep at most time limit. Along with deleting raw data and event data, Sentinel also deletes the corresponding data (document) in Elasticsearch. If a particular index in Elasticsearch does not contain any data, the index will also be deleted.
Sentinel does not delete data based on the disk usage. You must manually monitor the disk usage in the CDH UI and take appropriate measures to avoid data deletion.