It's probably a good idea to work this out before you need it again. The log is the first place to look when things go wrong. By default Elasticsearch logs most things to stdout, and I think the default for the Docker image is to also log to /usr/share/elasticsearch/logs which you can bind-mount to somewhere persistent.