Where does Elasticsearch store its data?

Question

So I have this Elasticsearch installation, in insert data with logstash, visualize them with kibana.

Everything in the conf file is commented, so it's using the default folders which are relative to the elastic search folder.

1/ I store data with logstash
2/ I look at them with kibana
3/ I close the instance of elastic seach, kibana and logstash
4/ I DELETE their folders
5/ I re-extract everything and reconfigure them
6/ I go into kibana and the data are still there

How is this possible?

This command will however delete the data : curl -XDELETE 'http://127.0.0.1:9200/_all'

Thanks.

ps : forgot to say that I'm on windows

Did you try to access Kibana from an incognito window in Chrome for example? It might be the browser's cache that is retrieved when you search for the data. — bogdan.rusu, Jul 30 '17 at 11:51

Val · Accepted Answer · 2015-10-23T14:06:18.923

48

If you've installed ES on Linux, the default data folder is in /var/lib/elasticsearch (CentOS) or /var/lib/elasticsearch/data (Ubuntu)

If you're on Windows or if you've simply extracted ES from the ZIP/TGZ file, then you should have a data sub-folder in the extraction folder.

edited Oct 23 '15 at 14:06

answered Oct 23 '15 at 13:47

Val

207,596
13
358
360

That's what I'm saying, I have a data folder, however kibana still display the data even after deletion of this data folder – sliders_alpha Oct 23 '15 at 15:30
On what system are you? Linux or Windows? And how did you delete the ES folder? – Val Oct 23 '15 at 15:32
I go to the "project' folder which contains the "elasticsearch-1.7.2" folder, right clic and erase it (and yes, I stopped the elastic search instance before – sliders_alpha Oct 23 '15 at 15:34
4

you are right, but my problem was in fact because we were several people on the network running the same conf and our data were shared. 3 years later, I know :p – sliders_alpha Jul 10 '18 at 22:24
On Elastic Search 7 on Ubuntu, the path is also /var/lb/elasticsearch – Josir Feb 18 '21 at 12:13

score 18 · Answer 2 · answered Dec 04 '18 at 11:30

18

Have a look into the Nodes Stats and try

http://127.0.0.1:9200/_nodes/stats/fs?pretty

On Windows 10 with ElasticSearch 7 it shows:

"path" : "C:\\ProgramData\\Elastic\\Elasticsearch\\data\\nodes\\0"

answered Dec 04 '18 at 11:30

C-Jay

621
1
11
22

Andrew Smith · Answer 3 · 2017-05-15T23:11:03.160

6

According to the documentation the data is stored in a folder called "data" in the elastic search root directory.

edited May 15 '17 at 23:11

answered Oct 23 '15 at 13:48

Andrew Smith

1,634
10
11

Yes, but the data are still present event after deletion of elastic search root directory – sliders_alpha Oct 23 '15 at 15:31
You are probably running into a cache at that point. The delete command you are sending using CURL would be the proper way to handle this. – Andrew Smith Oct 23 '15 at 15:33
This is just about curiosity, where is this cache? since I erased everything. Does it store something in appdata? – sliders_alpha Oct 23 '15 at 15:35

score 5 · Answer 4 · answered Sep 07 '17 at 01:23

5

If you run the Windows MSI installer (at least for 5.5.x), the default location for data files is:

C:\ProgramData\Elastic\Elasticsearch\data

The config and logs directories are siblings of data.

answered Sep 07 '17 at 01:23

Noah Heldman

6,724
3
40
40

score 3 · Answer 5 · answered Nov 30 '17 at 17:09

Elastic search is storing data under the folder 'Data' as mentioned above answers. Is there any other elastic search instance available on your local network? If yes, please check the cluster name. If you use same cluster name in the same network it will share data.

Refer this link for more info.

score 2 · Answer 6 · edited Jun 04 '18 at 08:26

2

On centos:

/var/lib/elasticsearch

edited Jun 04 '18 at 08:26

4b0

21,981
30
95
142

answered Jun 04 '18 at 08:21

Andrew Nguyen

39
4

score 0 · Answer 7 · edited Jul 11 '18 at 01:19

0

It should be in your extracted elasticsearch. Something like es/data

edited Jul 11 '18 at 01:19

Kamil Naja

6,267
6
33
47

answered Jul 10 '18 at 21:08

sandy.narwal

15
3

Where does Elasticsearch store its data?

7 Answers7

Linked