So I have this Elasticsearch installation, in insert data with logstash, visualize them with kibana.
Everything in the conf file is commented, so it's using the default folders which are relative to the elastic search folder.
1/ I store data with logstash
2/ I look at them with kibana
3/ I close the instance of elastic seach, kibana and logstash
4/ I DELETE their folders
5/ I re-extract everything and reconfigure them
6/ I go into kibana and the data are still thereHow is this possible?
This command will however delete the data : curl -XDELETE '
Thanks.
ps : forgot to say that I'm on windows
17 Answers
If you've installed ES on Linux, the default data folder is in /var/lib/elasticsearch (CentOS) or /var/lib/elasticsearch/data (Ubuntu)
If you're on Windows or if you've simply extracted ES from the ZIP/TGZ file, then you should have a data sub-folder in the extraction folder.
Have a look into the Nodes Stats and try
On Windows 10 with ElasticSearch 7 it shows:
"path" : "C:\\ProgramData\\Elastic\\Elasticsearch\\data\\nodes\\0"According to the documentation the data is stored in a folder called "data" in the elastic search root directory.
3If you run the Windows MSI installer (at least for 5.5.x), the default location for data files is:
C:\ProgramData\Elastic\Elasticsearch\dataThe config and logs directories are siblings of data.
Elastic search is storing data under the folder 'Data' as mentioned above answers. Is there any other elastic search instance available on your local network? If yes, please check the cluster name. If you use same cluster name in the same network it will share data.
Refer this link for more info.
On centos:
/var/lib/elasticsearchIt should be in your extracted elasticsearch. Something like es/data
