elasticsearch/docs/reference/setup/important-settings/path-settings.asciidoc

{es} writes the data you index to indices and data streams to a `data`
directory. {es} writes its own application logs, which contain information about
cluster health and operations, to a `logs` directory.

For <<targz,macOS `.tar.gz`>>, <<targz,Linux `.tar.gz`>>, and
<<zip-windows,Windows `.zip`>> installations, `data` and `logs` are
subdirectories of `$ES_HOME` by default. However, files in `$ES_HOME` risk
deletion during an upgrade.

In production, we strongly recommend you set the `path.data` and `path.logs` in
`elasticsearch.yml` to locations outside of `$ES_HOME`. <<docker,Docker>>,
<<deb,Debian>>, and <<rpm,RPM>> installations write
data and log to locations outside of `$ES_HOME` by default.

Supported `path.data` and `path.logs` values vary by platform:

include::{es-ref-dir}/tab-widgets/customize-data-log-path-widget.asciidoc[]

include::{es-ref-dir}/modules/node.asciidoc[tag=modules-node-data-path-warning-tag]