Where Is Elasticsearch Data Stored?
Default Elasticsearch data and log directories on Linux and Windows.
Last updated
Elasticsearch separates indexed data (path.data) from application logs (path.logs), set in elasticsearch.yml. Package installs use system directories outside the install folder.
Archive installs default inside the unpacked directory, which risks deletion on upgrade. Production setups should point both paths outside the install directory.
Where Elasticsearch stores this, by platform
/var/lib/elasticsearch
Default path.data on Debian and RPM installs. Logs default to /var/log/elasticsearch with config at /etc/elasticsearch/elasticsearch.yml. Tarball installs instead use $ES_HOME/data and $ES_HOME/logs where $ES_HOME is the unpacked directory. Check path.data and path.logs in elasticsearch.yml because both accept single or multiple locations.
C:\ProgramData\Elastic\Elasticsearch\data
Default DATADIRECTORY for MSI installs, resolving from %ALLUSERSPROFILE%\Elastic\Elasticsearch\data. Logs default to C:\ProgramData\Elastic\Elasticsearch\logs and config to C:\ProgramData\Elastic\Elasticsearch\config. Zip installs instead use %ES_HOME%\data, %ES_HOME%\logs, and %ES_HOME%\config\elasticsearch.yml where %ES_HOME% is the unpacked folder. Service wrapper logs are separate from application logs controlled by path.logs.
Frequently asked questions
How do I confirm the active data path?
Open elasticsearch.yml and read path.data and path.logs, or query the node settings API. Package defaults are /var/lib/elasticsearch and /var/log/elasticsearch on Linux, but a custom config overrides them.
Why is data missing after upgrade from a zip install?
Zip and tarball defaults live under the install directory, so replacing that folder removes data and logs. Move path.data and path.logs outside the install directory before upgrading and back up the config directory.
Notice an outdated path? Let us know.