Error in changing the log directory for Elasticsearch

Question

I am changing the path of -

path.data: /var/log/elasticsearch to path.data: /data/elasticsearchdata/log/elasticsearch/

in elasticsearch.yml

file after creating the folder and moving the files/folders from ../elasticsearch to /data/elasticsearchdata/log/

but after doing the changes in - elasticsearch.yml I have run the command as - sudo systemctl restart elasticsearch

But getting this error -

● elasticsearch.service - Elasticsearch
 Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
 Active: failed (Result: exit-code) since Wed 2021-12-15 14:53:14 UTC; 7s ago
   Docs: https://www.elastic.co
Process: 1678664 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE)
Main PID: 1678664 (code=exited, status=1/FAILURE)
Dec 15 14:53:14 ip-10-10-6-161 systemd-entrypoint[1678664]:      path.logs: /data/elasticsearchda ...

Can anyone let me know what I am missing ?

Answer 1

ONLY WAY to move your data is

1. setup repository (snapshot/restore)
2. create snapshot of all indices
3. shut down ELK cluster and edit path.data in elasticsearch.yml
4. start ELK cluster
5. restore snapshot
6. data should appear in the new location