Hi everyone!
Has anyone ever encountered the transfer of an opensearch data folder to another location on the node?
In our case we need to replace data folder from default location to custom.
When we tried to do this, the graylog instance stopped running
Our environment is:
thanks in advance
Hey @igoriceg
If its a fresh install before staing OS up
I have change mine to a different location. My new mount point is on a second drive.
Default Location
path.data: /var/lib/opensearch
After
/mnt/opensearch
Ensure OpenSearch has permissions to new directory.
chown opensearch:opensearch /mnt/opensearch
If you have the default location working all ready and need it to be move it to a different location I would suggest using Rsync and move files
( rysnc -r /origin/* /target/). And again ensure the correct permissions is on the new directory for OpenSearch. You may have to shutdown your services first.
Always make sure you back everything up 
Hi! Thanks for answer
But if i want to make new data folder for opensearch without moving old files - what must i do?
Hey @igoriceg
Then don’t move them. You will run into issues with MongoDb trying to find settings and index sets.
Hi and thanks for answer
unfortunelly, i cant find any items in mongodb, which can be related with opensearch/data folder
so i think if i can understand how folders was formed inside these path (/opt/opensearch/data/nodes/0/indices) i guess i can find answer for my question
Hey @igoriceg
MongoDb holds metadata, like settings, etc…
Maybe something else location exists where i can find information about meta folders in opensearch/data?
Hey @igoriceg
In your OpenSearch configuration file called opensearch.yml. The setting for your Data folder is
path.data: /var/lib/opensearch
I’m not sure why it was set to /opt/opensearch/data/nodes/0/indices
To confirm what I just said, here is an example of mine with default configurations
root@graylog:/etc/graylog/server# cd /var/lib/opensearch
root@graylog:/var/lib/opensearch# ls -al
total 32
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 .
drwxr-xr-x 45 root root 4096 Apr 8 21:44 ..
-rw-r--r-- 1 opensearch opensearch 5 Apr 8 21:39 batch_metrics_enabled.conf
-rw-r--r-- 1 opensearch opensearch 5 Apr 8 21:39 logging_enabled.conf
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 nodes
-rw-r--r-- 1 opensearch opensearch 4 Apr 8 21:39 performance_analyzer_enabled.conf
-rw-r--r-- 1 opensearch opensearch 4 Apr 8 21:39 rca_enabled.conf
-rw-r--r-- 1 opensearch opensearch 5 Apr 8 21:39 thread_contention_monitoring_enabled.conf
root@graylog:/var/lib/opensearch# cd nodes
root@graylog:/var/lib/opensearch/nodes# ls -al
total 12
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 .
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 ..
drwxr-xr-x 4 opensearch opensearch 4096 Apr 8 23:23 0
root@graylog:/var/lib/opensearch/nodes# cd 0
root@graylog:/var/lib/opensearch/nodes/0# ls -al
total 16
drwxr-xr-x 4 opensearch opensearch 4096 Apr 8 23:23 .
drwxr-xr-x 3 opensearch opensearch 4096 Apr 8 19:19 ..
drwxr-xr-x 2 opensearch opensearch 4096 Apr 8 21:58 _state
drwxr-xr-x 6 opensearch opensearch 4096 Apr 8 19:33 indices
-rw-r--r-- 1 opensearch opensearch 0 Apr 8 19:19 node.lock
root@graylog:/var/lib/opensearch/nodes/0#
Its not in OpenSearch, its in MongoDb and the database should be called graylog.
Graylog uses MongoDB to store data. Only metadata such as user information and stream configurations are stored here, not log data. So MongoDB will not have a huge system impact. It runs alongside the Graylog server processes and takes up minimal space.
That is from here
It explain what all the functions are for.
Hi @gsmith !
In my config file for opensearch data path is:
path.data: /opt/opensearch/data/
and if we go to the location
/opt/opensearch/data/node/0/indices/
and if i change data folder path to my custom - is cant see new folders
example:
working structure:
/opt/opensearch/data/node/0/indices
non working structure
/opt/opensearch/indexies/node/0/
so folder indices non created
And
32OEv_bWTVytcoVPNlDZGQ
3cB3Xw9DS6-fjSpoS4fA-w
4cJbq2_RSQuoUzY78AUztg
4W5dqFehSBu3MkvFP3F7Rw
5fHUhP5VRNOleH_DDzMiOw
Bj6rPEG9Tyi0i5xAqw09nQ
bOR3Sn_mTSuIOuOvJTHdIg
cZEnKk9FTVGK0GBNMA9qdw
dKHm495-TqyZjkJclovTiA
EFFIIxuBTC2VFDcXRno7Aw
g-LZf7_XRjSaRiI8wdMDYw
Gw7ZK7v8Q1u6Z0alA7D1_A
gyMgKw3qRAuUP5ADMxb6mw
hKrZZRPTSkyApCiDmVuAkQ
JlxpyZEZQu6pibxVhIRa_w
jpS2VRRuSv-F5rsmmv9lrQ
Kp6YYNaIRkCDhDMyTMpbRw
ktsoAgvjTxWT282DMDGa6g
LMKYeWxcTWeFsScVSJvDeg
lwgyrX5zSXycNhmekYCXqA
MhmvK2USSXGATLxs8WzJrg
POdpXo5ATWG54iZuyleJtg
pumbB7WnSGmeF6dDRLxrZQ
QnfvB5HMQ4OaIQrijuh7KA
rHFCfy3NR7ycpe05TMlGww
rqFduTzTT5magrfQrP3UmQ
s1KHXBR6QMOJay8a2lkCwA
SMzs7EIUSdS4MvLC-4iVCA
sRsw_lKhQ4GnPwnmwv_geg
TCJWe7C0SlelQMdRFdoZmw
tMtrDjnVTpeuSiSetOvfDQ
ToAxeIEJQWK_7YfMdyROvg
UM_OPzuDRAanwmDTEWpZ9g
_uXSGmUhQcWLNX4oBwQw9g
v-r1LZE7QS-7NN0QvLCBgA
wpkiEANKTzqlqZI56RIcwg
X1lxDRiiSj6gPn_5EBJvIA
xFEM_ts_TDa5jytySr5qzg
x_kgiLh9QHKL4vBEpU_SjA
xuozPsi4ReC_fjo8I4U51A
yafJYUakSyysTEbWbEYh8w
YKnU87JOQzWX2jgagwtC3w
Yx4YLJ2bSq6CBJ9dCW5GwQ
z7-0_4NhTpiP0dpu277UZA
ZLKU-8jmTSCwE7Xwido-6w
these names i cant find in mongodb
i guess i connect to mongodb via mongosh
i see database graylog (in mongodb was created graylog, local, system db - not opensearch or else ELK items) - and i cant find any item or something else related to graylog stack
hey @igoriceg
That make sense,
Your configuration file is set path.data: /opt/opensearch/data/
If you want to change it then set it path.data: /opt/opensearch/indices/
and restart services. You should stop all the services. Then reconfigure OpenSearch data path do not add node/0/indeices that will happen when you start everything back up. Start OpenSearch backup to take affect. Then start MongoDb back up ensure there is no errors. once completed start Graylog server up and TAIL the log file for any error. Basically with out syncing the data folder it would be like a fresh install.
If this is incorrect and you want your old data then you need to Sync it like i stated above.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.