# elasticsearch previous logs gone after adding ssl/https

**URL:** <https://discuss.elastic.co/t/elasticsearch-previous-logs-gone-after-adding-ssl-https/378609>\
**Category:** Elasticsearch\
**Created:** [May 27, 2025, 6:55pm UTC](https://discuss.elastic.co/t/elasticsearch-previous-logs-gone-after-adding-ssl-https/378609 "2025-05-27T18:55:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yyhk123](https://avatars.discourse-cdn.com/v4/letter/y/d26b3c/32.png) [@yyhk123](https://discuss.elastic.co/u/yyhk123)\
**Post date:** [May 27, 2025, 6:55pm UTC](https://discuss.elastic.co/t/elasticsearch-previous-logs-gone-after-adding-ssl-https/378609/1 "2025-05-27T18:55:46Z")

</div>

I was using elasticsearch without ssl/https enabled, then when I enabled it, the previous logs were all gone, but still remains in the vm in /data/elasticsearch, whereas the original path was /home/user/elasticsearch

i am able to see the nodes in /data/elasticsearch/data/0/nodes/indices but even i move them to where the elasticsearch is running, (/home/user/elasticsearch/data/0/nodes) i am unable to see the previous logs.

it says its because the uuid does not match, so i even copied \_state folder from a working path to indices that is not showing, but unable to retreive the data.

How can i retrieve the lost data that still remains in the vm?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [May 29, 2025, 8:19am UTC](https://discuss.elastic.co/t/elasticsearch-previous-logs-gone-after-adding-ssl-https/378609/2 "2025-05-29T08:19:36Z")

</div>

Sorry, I don't really understand what changes you made, or what behaviour you saw.

Can you try to explain it step by step, with specific details about

- What you changed (exact settings, etc)
- What messages you saw either in the logs or in API responses
- What other symptoms you noticed (and how you observed them)

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [May 29, 2025, 9:44am UTC](https://discuss.elastic.co/t/elasticsearch-previous-logs-gone-after-adding-ssl-https/378609/3 "2025-05-29T09:44:42Z")

</div>

Welcome to the forum.

if elasticsearch is now writing data to `/data/elasticsearch` and was writing data to `/home/user/elasticsearch` (which suggests it was running as user), then you did more than "add ssl/https'. Perhaps you are now even running elasticsearch as a different user?

You need to share the config files (before / after, which location, ...), and the exact commands you are using.

The group can be very helpful, I still think you can recover your situation, but you need to share far more information.