How to move Data and Logs to new directory?

Elastic Stack Elasticsearch
1

I installed ElasticSearch using defaults. Now my /var directory is full. I'd like to move ES to a different partition on the server without losing data. Can this be done and if so, how?

More specifically, I'd like to move data and logs to /spare >

Filesystem Size Used Avail Use% Mounted on
/dev/sda6 969M 341M 562M 38% /
devtmpfs 16G 0 16G 0% /dev
tmpfs 16G 0 16G 0% /dev/shm
tmpfs 16G 1.6G 15G 10% /run
tmpfs 16G 0 16G 0% /sys/fs/cgroup
/dev/sda1 12G 1.7G 9.2G 16% /usr
/dev/sdb1 1.7T 77M 1.6T 1% /spare
/dev/sda3 1.9G 82M 1.7G 5% /home
/dev/sda2 8.6G 8.4G 0 100% /var
/dev/sda7 250G 61M 237G 1% /data

-Thanks

2

You can set that in elasticsearch.yml using these - https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-dir-layout.html

3

Thanks Mark, but I was looking for more detailed steps. Here's what I ended up doing in case anyone else is looking for this information the future. >

• Determine current location of data files > curl "localhost:9200/_nodes/settings?pretty=true"

• Create new directory structure - e.g; > cd /spare > mkdir data

• Stop ntopng service > systemctl stop ntopng.service

• Stop ES service > systemctl stop elasticsearch.service

• Navigate to the current Data Directory determined in step 1 and copy files to new location > cp -RP * /spare/data/

• Change ownership on new directory to elasticsearch > chown -R elasticsearch:elasticsearch /spare/data

• Edit data path > vi /etc/elasticsearch/elasticsearch.yml
*Edit data parameter “path.data:” to “path.data:/spare/data

• Start ES > systemctl start elasticsearch.service

• Start ntopng > ntopng -F "es;flows;ntopng-%Y.%m.%d;http://127.0.0.1:9200/_bulk;" -e -i 1
*careful on this command as your input interface may not be -e -i 1 and your IP may be different.

Worked!!

15 Likes