Where does Elasticsearch store logs?


I am using a VM to explore the X-pack.
I want to send some logs from the production servers (Elasticsearch and Splunk) to that VM.

Where are the logs stored in Elasticsearch? Is there a path (ex: /var/log/)? I would like to use SFTP (as I want to send "some" logs. Not everything).

I posted a question in august: elastic X-pack vs Splunk MLTK

Thank you

You can configure it to location you want by setting "path.logs:" value in elasticsearch.yml file. The location is $ES_HOME/logs.

Hi @jay224

I used this: curl "localhost:9200/_nodes/settings?pretty=true" to find the home directory.

From it I got this:

Do you mean this: "logs": "/var/log/elasticsearch" ?
I have checked it. But it is not what I am looking for. Those are my own logs.
I am using a VM to test Elasticsearch. So I have uploaded some logs from the production servers and some free .csv files available online.

My question should have been: When using the "Data visualizer" to upload CSVs, JSON or "LOGS", what is the path were these are going to be stored?

That data gets indexed into elasticsearch, you can configure that location using "path.data:" in your case it is default /var/lib/elasticsearch. The data is indexed data and not your original files.

So these are the logs, .csv and .json?

Okey, I have 2 questions:
a) What does "repo": [ "/BST_data"] mean?

b) Is this the place were I have to put my data when I use SFTP?

path.repo is snapshot location, it used by elasticsearch to store snapshot information. No, you will not use this location for uploading data files.


What is snapshot information? It seems like it is a copy of an index of the production servers. -----I have just started with Elasticsearch, so I do not know too much.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.