Data and indexes lost after restart

Elastic Stack Elasticsearch
1

Hi,

I've lost all my data when restarting Elasticsearch. My indexes still seemed to be there (they were visible with a curl -u user:pass -XGET http://localhost:9200/_cat/indices?v, but no index patterns were visible in Kibana, I had to reimport the dashboards to see the index patterns in Kibana).

Here's my elasticsearch config (I'm running ELK with Docker) :

 services:

   elasticsearch:
     image: 8a0824e0a178
     container_name: elk5_elasticsearch
     hostname: elasticsearch
     ports:
       - 9200:9200
       - 9300:9300
     environment:
       - cluster.name=docker-elk5
       - node.name=elk5
       - bootstrap.memory_lock=true
       - network.host=172.25.3.18
       - network.bind_host=0.0.0.0
       - transport.tcp.port=9300-9400
       - transport.host=172.25.3.18
       - transport.bind_host=0.0.0.0
       - "ES_JAVA_OPTS=-Xms4g -Xmx4g"
       - discovery.zen.ping.unicast.hosts=172.25.3.18:9300
     ulimits:
       memlock:
         soft: -1
         hard: -1
       nofile:
         soft: 65536
         hard: 65536
     cap_add:
       - IPC_LOCK
     volumes:
       - elastic:/usr/share/elk5/elasticsearch
     restart: on-failure

   kibana:
     image: 7127e5b79a23
     container_name: elk5_kibana
     hostname: kibana
     ports:
       - 5601:5601
     environment:
       - ELASTICSEARCH_URL="http://172.25.3.18:9200"
       - elasticsearch.username=elastic
       - elasticsearch.password=changeme
       - xpack.monitoring.ui.container.elasticsearch.enabled=true
     links:
       - elasticsearch
     volumes:
       - kibana:/usr/share/elk5/kibana
     restart: on-failure

   logstash:
     image: 684de72d85c6
     container_name: elk5_logstash
     environment:
       - ELASTICSEARCH_URL="http://172.25.3.18:9200"
       - xpack.monitoring.elasticsearch.username=elastic
       - xpack.monitoring.elasticsearch.password=changeme
       - path.config=logstash/logstash.conf
     volumes:
       - logstash:/usr/share/elk5/logstash
     restart: on-failure
    
volumes:
   kibana:
      driver: local
   elastic:
      driver: local
   logstash:
      driver: local

How can I avoid data loss when restarting ELK?

Thank you

2

I think I found the solution.

It seems that my docker volumes were not mounted correctly.

I corrected it and now I can find my indexes and dashboards when restarting ELK.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.