Where Does Elasticsearch Store Data and Config?
Elasticsearch splits path.data from elasticsearch.yml by install type. Package vs archive defaults.
Last updated
Elasticsearch writes indices into the path.data directory and reads node settings from elasticsearch.yml. Package installs (Debian, RPM) default to /var/lib/elasticsearch for data and /etc/elasticsearch for config. Archive installs (.tar.gz, .zip) default both under $ES_HOME instead.
That archive default is the trap: upgrades wipe $ES_HOME and take the data with it. Set path.data and path.logs outside the home in production. The config dir itself moves with ES_PATH_CONF, sourced from the OS specific defaults files rather than your shell.
Where Elasticsearch stores this, by platform
/var/lib/elasticsearch
Package default; config at /etc/elasticsearch/elasticsearch.yml. Archive installs use $ES_HOME/data instead, so confirm which install type you run before digging.
Frequently asked questions
how do i find my live elasticsearch data path
Read path.data in the active elasticsearch.yml, or check the process flags for -Epath.data. Package and archive defaults differ, so the config wins over any guide.
can i move elasticsearch data to a bigger disk
Yes. Stop the node, move the directory with permissions intact, set path.data to the new spot, and restart. Each node needs its own path; sharing one across nodes corrupts indices.
Notice an outdated path? Let us know.