Elastic Partition Problem

Elastic Security
1

Just came across a prolem
from the start i was installing elastic(Elasticsearch-kibana-logstash) via packge mangers either apt or deb packages (DPKG) so the storage is handled by them only

but in splunk we used to make partitions like
root-20
boot-3
var -7
other/opt - 70 ( here we install our splunk )

so how can we do the same for elastic
while going through documnetation when we do it with tar files many problems were occuring like
first in installation --> then it runs in front end --> i think so we need to change the elasticsearch.yml also and most of the times corrupt the whole thing

so can anybody please guide me with this

2

Hello,

How you partition your system is unrelated to Elasticsearch, you can change where it will store its data by changing the path.data setting in elasticsearch.yml as you can check here in the documentation.

When installing using package manager path.data will use the default value which is inside /var/lib/elasticsearch if I'm not wrong.

But you can change it to something like /opt/elasticsearch for example.

You just make sure that the user running the Elasticsearch service, which is normally elasticsearch, will have full permissions on that path.

3

What you’re asking is more of a general Linux/system administration question than an Elasticsearch one as @leandrojmp wrote. How you assign disk space and partitions is up to you, but there are many tools that can automate stuff like this. Puppet, Ansible, etc. You can also inspect the pre- and post-install scripts included in the rpm/deb packages to see exactly what they do, they are just shell scripts.

You also recently asked a "how to size an elasticsearch solution" question, which if read a bit unkindly was not far from "how long is a piece of string". This is a bit worrying.

Everyone starts somewhere. We all had a first cluster, then a first production cluster, and so on. But if you’re taking on responsibility for deploying and administering Elasticsearch clusters for paying customers, and in a previous post you mentioned MSSP, it’s worth spending time building up the underlying skills, as well as learning how Elasticsearch itself works in some detail, ideally IMO via some formal training. If I were in your shoes, I’d be asking myself whether I had enough real world experience for the current task, or whether I should spend some time filling in those gaps before deploying and managing Elasticsearch for paying customers.