# Logstash data storage

**URL:** <https://discuss.elastic.co/t/logstash-data-storage/133468>\
**Category:** Logstash\
**Created:** [May 28, 2018, 6:32am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468 "2018-05-28T06:32:37Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\
**Post date:** [May 28, 2018, 6:32am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468/1 "2018-05-28T06:32:37Z")

</div>

Hello all  
I am running my ELk stack on docker so whenever my logstash loses connection with elasticsearch then the data which is getting parsed where is it stored.  
According to my observation it is piling up the logstash containers, so is there a particular directory inside the conatiner which it is supposed to pile up if yes then will mounting the directory as a volume outside the conatiner will it help?

Regards  
Gaurav Agarwal

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 28, 2018, 7:21am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468/2 "2018-05-28T07:21:51Z")

</div>

> According to my observation it is piling up the logstash containers, so is there a particular directory inside the conatiner which it is supposed to pile up

The data directory. See [Logstash Directory Layout | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/dir-layout.html).

> if yes then will mounting the directory as a volume outside the conatiner will it help?

Yes.

---

<div class="post-metadata">

**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\
**Post date:** [May 28, 2018, 8:01am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468/3 "2018-05-28T08:01:22Z")

</div>

Is it the data directory which should be mounted outside since I m not very sure where is the storage piling up is happening?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 28, 2018, 8:43am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468/4 "2018-05-28T08:43:55Z")

</div>

> Is it the data directory which should be mounted outside

I already answered that question.

> since I m not very sure where is the storage piling up is happening?

But that's easy to check, isn't it?

---

<div class="post-metadata">

**Author:** ![Gaurav\_Agarwal](https://avatars.discourse-cdn.com/v4/letter/g/9fc29f/32.png) [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\
**Post date:** [May 28, 2018, 9:42am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468/5 "2018-05-28T09:42:08Z")

</div>

It says the data directory is not writable.

[2018-05-28T09:35:49,874][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ArgumentError: Path "/usr/share/logstash/data" must be a writable directory. It is not writable.\>,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 28, 2018, 9:52am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468/6 "2018-05-28T09:52:18Z")

</div>

And this happens when mounting a directory from the host...?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2018, 9:52am UTC](https://discuss.elastic.co/t/logstash-data-storage/133468/7 "2018-06-25T09:52:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
