You need to install another instance using the
.tar.gz file, according to the documentation.
/etc/elasticsearch/ directory and files are used by the packaged installation,
.deb, you won't use this directory, you need to install the
.tar.gz in another directory, for example,
Then you will need to edit
elasticsearch.yml in this installation and configure your new node, just remember that the data dir and log dir should be different, you will also need to create a
systemd service if you want to run this new instance as a service.
But as I said, running two nodes in the same server, depending on your hardware configuration, could degrade the performance of your cluster. I still don't see the reason to run a hot and cold node on the same server, they share the same resources, even if you set your cold node to use
best_compression, it would use more CPU of the same server, which would impact your hot node as well, it doesn't justify the work to keep two instances on the same machine. If you need to store 1 year of logs that amount to 10 TB, one server won't help you. If you do not need to search those logs, just store them, you can use snapshots on s3, which could be cheapear than using spinning up another VM.