# Log file size of elasticsearch

**URL:** <https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757>\
**Category:** Elasticsearch\
**Created:** [June 3, 2016, 6:21am UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757 "2016-06-03T06:21:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 3, 2016, 6:21am UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757/1 "2016-06-03T06:21:42Z")

</div>

I have been running 4 servers including ELK itself with topbeat and packetbeat installed to send data to elasticsearch. When I undergoes to look for the logs file in elasticsearch, it is just an average 10kb for a single log file of that day. It seems incredibly small. I would like to ask if it is normal or unusual?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 3, 2016, 7:15am UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757/2 "2016-06-03T07:15:54Z")

</div>

That sounds normal. When things are working well ES doesn't log much.

---

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 3, 2016, 7:16am UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757/3 "2016-06-03T07:16:50Z")

</div>

So where would the data be stored in elasticsearch when the data are incoming from beats

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 3, 2016, 7:33am UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757/4 "2016-06-03T07:33:29Z")

</div>

Aren't we talking about the logs of Elasticsearch itself, typically stored in /var/log/elasticsearch?

---

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 3, 2016, 7:49am UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757/5 "2016-06-03T07:49:04Z")

</div>

I originally though all the incoming beats data will be stored as log data in elasticsearch, but seems that as like what you have said, the log directories only store elasticsearch log error. So I am wondering **where the beats data have gone as I am wondering how much file space is needed to allocate for ELK server.**

I have accidentally found that there are an index file in elasticsearch which also stored and saved data daily. I would like to know **if the index directory is storing the data for beats packets**.

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 3, 2016, 11:21am UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757/6 "2016-06-03T11:21:01Z")

</div>

Elasticsearch stores the data in its data directory. The location is configurable, but I think it's usually /var/lib/elasticsearch. ES can also report information about the size of indexes via APIs. You should run a dashboard plugin like Marvel, kopf, or ElasticHQ to track the state of your cluster.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:46pm UTC](https://discuss.elastic.co/t/log-file-size-of-elasticsearch/51757/7 "2017-07-05T22:46:28Z")

</div>


