Move openserach data to another drive

Graylog Central (peer support)
1

1. Describe your incident:
Hi,
i need move opensearch data to another drive.

2. Describe your environment:

  • OS Information:
    Ubuntu 20
  • Package Version:
    Graylog 5
    Opensearch

3. What steps have you already taken to try and solve the problem?
I copy data folder to new location and create symbolic link, but no work.
Remove symbolic link and I changing path to /media/user/test/data in opensearch.service but they don’t work either.

4. How can the community help?
How i can move data folder to another disk?

2

Hey @michaal1511

Could try the following.

  1. Shut down opensearch.
  2. Move data to new path
  3. ensure Opensearch has access to new path.
  4. Modify opensearch.yaml file in this section to new path. path.data: /var/lib/opensearch
  5. Start Opensearch

No need for symbolic link.

3

Ok, i move only data folder with all collected logs to /media/dsadas/data
Next I add permissions sudo chmod -R 777 /media/dsadas/data' I change path.data: /media/dsadas/data’ in openserach.yml
Start again opensearch and check status on ‘Running’
Open web and error:
error
I check status again and failed
So opensearch start and in a while stop.

I back to defalut path and working fine.
What can I do?

4

Hey @michaal1511

I would look through the logs,not only Graylog but also Opensearch. Since it a service i would also look through.

root # journalctl -x

Not knowing whats in the logs or your configurations Im just guessing right now.

5

Sample log from graylog:

023-03-08T11:10:18.096+01:00 INFO  [IndexFieldTypePollerPeriodical] Cluster not connected yet, delaying index field type initialization until it is reachable.
2023-03-08T11:10:19.787+01:00 ERROR [Messages] Caught exception during bulk indexing: ElasticsearchException{message=OpenSearchException[An error occurred: ]; nested: ConnectException[Connection refused]; nested: ConnectException[Connection refused];, errorDetails=[]}, retrying (attempt #1).
6

Hey @michaal1511

Your problem is Elasticsearch, not Graylog at the moment.

So you did you try to raise the HEAP of Elasticsearch and not Graylog? what does the service logs show?

7

I use Opensearch, not Elasticsearch.
So i trying move data folder where Openserach collect all logs.
I don’t move Graylog. I want to move only data folder with collected logs.
I found in opensearch.service logs Unable to access path.data and java.nio.file.AccessDeniedException: /media/dsadas/data

8

I resolved problem.
Earlier I added path /media/disk/folder so I mount disk and I added /mnt/sdb/folder and work fine!
Thank you!

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.