1

I'm having a number of indices which are actually causing some space issues at the moment in my Ubuntu machine. The indices keep growing on a daily basis.

So I thought of moving it to another mount directory which has more space apparently. How can I do this safely?

And I have to make sure that the existing ES indices and the Kibana graphs would be safe enough after the doing the move.

What I did: Followed this SO and moved my data directory of Elasticsearch somehow to the directory (/data/es_data) I needed, but after I did that, I couldn't view my existing indices plus the Kibana graphs and dashboards which I created as well.

Am I doing something wrong? Any help could be appreciated.

Community
  • 1
  • 1
Kulasangar
  • 9,046
  • 5
  • 51
  • 82
  • Did you make sure to also change the `path.data` setting in your `elasticsearch.yml` configuration? What do you see in the `/data/es_data` folder now? – Val Jan 27 '17 at 07:07
  • 1
    It all depends on the way you installed as well. Did you use a package manager on linux (apt/yum), that way an elastic uses the process configuration to configure locations. For debian based systems: /etc/default/elasticsearch. More info can be found here: https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html – Jettro Coenradie Jan 27 '17 at 07:24
  • @Val It was my mistake, for not putting the exact path. :( Thanks again! JettroCoenradie +1 for the explanation. – Kulasangar Jan 27 '17 at 09:28
  • Cool, glad you figured it out – Val Jan 27 '17 at 17:56

1 Answers1

4

FWIW If it were me, I would stop elasticsearch & kibana (& logstash if this is the only elasticsearch node in the cluster) then move the old data dir to a new location out of the way:

sudo mv /var/lib/elasticsearch /var/lib/elasticsearch-old

Then set up the new volume (which should be at least 15% larger than the size of the indexes you have on disk as elasticsearch won't create new indexes on a disk with less than 15% free space) with a file system and find out it's UUID and get ready to mount it:

sudo fdisk /dev/sdX # New volume, use all the space
sudo mkfs.ext4 /dev/sdX1
ls -la /dev/disk/by-uuid/ | grep /dev/sdX1 # Or forget the grep and manually look for it

Then add the following to your /etc/fstab, replacing with the UUID from previous command:

UUID=<RESPONSE> /var/lib/elasticsearch  ext4 defaults 0 0

Make the new directory as the old one is gone, it probably wants chowning (I assume the owner should be elasticsearch but you can confirm by checking ownership of the old folder) and you want to copy the content from the old one:

sudo mkdir /var/lib/elasticsearch
sudo chown -R elasticsearch: /var/lib/elasticsearch
cp -rp /var/lib/elasticsearch-old/* /var/lib/elasticsearch

Once everything has finished copying across you should then be able to start elasticsearch back up, it should find the indexes as they haven't moved, config doesn't need updating.

Once you're happy that everything is working you can delete /var/lib/elasticsearch-old and reclaim your space. Failing that you can revert to the old data and it should continue to work.

Rumbles
  • 1,367
  • 3
  • 16
  • 40
  • Should I also have to point Kibana to pick up ES data from the new location? Or will it automatically pick it up? Is there any change, I should make in Kibana configuration? – Kulasangar Jan 27 '17 at 15:52
  • 1
    No kibana connects to elasticsearch through the database as normal – Rumbles Jan 30 '17 at 23:54