Help with storing logs on e:\

Elastic Stack Logstash
1

Hey all...Network guy here...I've got the ELK stack up and running on my test environment and everything is fine...

I've got the go ahead to put it in production -- where I have a 100GB HD for the OS and the services, and an external drive (E:\ in this case) where I want to store the log files.

Can someone kindly tell me how to set it up so all of the logs are stored on E:?

I've read some and investigated the files where someone said the log path was stored...but I found it a bit confusing (not a super systems guy here)...I'm running things on Windows Server if that matters.

Thanks so much!!

2

I assume you are storing the data in Elasticsearch, if so check out https://www.elastic.co/guide/en/elasticsearch/reference/2.3/modules-node.html#data-path.

It's set in elasticsearch.yml.

3

Thanks so much @warkolm ! I'm going to have a question incoming...

So I have two lines in there:

path.data: /path/to/data##

path.logs: /path/to/logs##

From what the article is saying, the path.data I want to change...but to me, it looks like it's in 'linux' format.

Essentially, if i do the following:

path.data: e:\elastdata##

That will put my data in that folder?

What about the path.logs -- sounds to me like logs are going to path.logs?

Thanks so much!

4

Just set path.data: E:/elastdata. The path.logs is optional, logs will stay in ES installation folder

5

Alright, thanks so much. I'll try it in the morning...thanks a lot for the help.

6

I've changed the following:

path.data: e:\elas\data
path.logs: e:\elas\logs

restarted the services, and the logs are not going to e:\

I then created the corresponding folders, restarted the services

and they are just empty folders.

Kibana is still showing new syslog information in the search...so the logs are just getting stored in the default location.

7

OK thanks -- I got it working.

Apparently editing in Windows Notepad.exe corrupts the YAML file.

So I replaced my configuration file with the new, default one.
Used Notepad++ to edit the configuration this time
Restarted the services
and now it's working properly and storing logs on the e drive.

Going to add YAML to my resume :wink:

8

Stay away from the Windows notepad for most config files ^^. Glad to hear your ES is working now.