Where does Elasticsearch store logs?

[Rosho]

Hi

I am using a VM to explore the X-pack.
I want to send some logs from the production servers (Elasticsearch and Splunk) to that VM.

Where are the logs stored in Elasticsearch? Is there a path (ex: /var/log/)? I would like to use SFTP (as I want to send "some" logs. Not everything).

I posted a question in august: elastic X-pack vs Splunk MLTK

Thank you

[jay224 (j s)]

You can configure it to location you want by setting "path.logs:" value in elasticsearch.yml file. The location is $ES_HOME/logs.

[Rosho]

Hi @jay224

I used this: curl "localhost:9200/_nodes/settings?pretty=true" to find the home directory.

From it I got this:

Do you mean this: "logs": "/var/log/elasticsearch" ?
I have checked it. But it is not what I am looking for. Those are my own logs.
I am using a VM to test Elasticsearch. So I have uploaded some logs from the production servers and some free .csv files available online.

My question should have been: When using the "Data visualizer" to upload CSVs, JSON or "LOGS", what is the path were these are going to be stored?

[jay224 (j s)]

Oh!!
@Rosho
That data gets indexed into elasticsearch, you can configure that location using "path.data:" in your case it is default /var/lib/elasticsearch. The data is indexed data and not your original files.

[Rosho]

@jay224
So these are the logs, .csv and .json?

Okey, I have 2 questions:
a) What does "repo": [ "/BST_data"] mean?

b) Is this the place were I have to put my data when I use SFTP?

[jay224 (j s)]

path.repo is snapshot location, it used by elasticsearch to store snapshot information. No, you will not use this location for uploading data files.

[Rosho]

@jay224

What is snapshot information? It seems like it is a copy of an index of the production servers. -----I have just started with Elasticsearch, so I do not know too much.