Where can I access the logs sent to Elasticsearch?

[BenGur]

Hello,

I am trying to access the log files sent to Elasticsearch outside of the Kibana browser but don't know where to find them.

I am running Elasticsearch on a remote CentOS 7 server with another AWS CentOS 7 server sending it Nginx logs with Filebeat. I have tried navigating to /var/lib/Elasticsearch/indexes but am unsure where to go from there or what to make of the files I found.

Ideally I would be able to open and move the parsed log files received by Elasticsearch (the JSON's on Kibana would be great).

Thank you

[warkolm (Mark Walkom)]

Welcome to our community!

You should never work with the Elasticsearch files on the filesystem, always use the APIs. Can you elaborate more on what you're trying to do?

[leandrojmp (Leandro Pereira)]

You can't access the files directly, it is not possible.

Elasicsearch is REST based, to see what you have stored without using a visualization tool like Kibana, or something like Grafana, you would need to make a request using the Search API and work with the result.

For example, if you have an index named nginx-logs and want to see what you have stored a simple GET request using curl would return you some data.

curl -X GET "localhost:9200/nginx-logs/_search?pretty"

You also can use the Query DSL to make more complex queries with filters and things like that.

It is also possible to write some tool or script using one of the clients to retrieve and parse the logs.

[BenGur]

Got it, thank you!