0

I have an ELK with 400GB of logs, had to change some settings and delete old ES container, but when I created the new one, lost my previous logs, the logs are still there though at a folder in the host running docker at /elasticsearch/nodes/0

How can I get them back?

(newbie on this stack, I'm going through the docs right now) Thanks!

4
  • Just to clarify, you have deleted your old container, or stopped? Is it still being listed if you will type docker ps -a? Nov 7, 2018 at 20:09
  • Create a new container, mount your logs folder to a dir in the container if that is what yo are asking ?
    – ben5556
    Nov 7, 2018 at 21:37
  • You might see if it recovers itself given some time. If you have that much data, and not losing it is important, also consider running a 3-node ES cluster with 2 replicas of each shard (so a single node going down doesn't cause data loss), and routinely backing up the data to somewhere else.
    – David Maze
    Nov 8, 2018 at 0:48
  • I deleted the docker so wasn't stopped. Finally found the docker-compose file and after doing some changes (fixing the root cause of ES getting crashed) I was able to get the logs again. I'm planning on making it to k8s, first wanted to get more knowledge on ELK.
    – Rancor
    Nov 20, 2018 at 0:16

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.