From 74daa8feb9473c45f657250f57a884c30dcb55b6 Mon Sep 17 00:00:00 2001
From: Knut Ahlers <knut@ahlers.me>
Date: Sat, 13 Jan 2018 19:47:45 +0100
Subject: [PATCH] Store data on log volume

Signed-off-by: Knut Ahlers <knut@ahlers.me>
---
 filebeat.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/filebeat.yml b/filebeat.yml
index 398af52..ffd30bc 100644
--- a/filebeat.yml
+++ b/filebeat.yml
@@ -19,6 +19,7 @@ output.elasticsearch:
   index: "vault-audit-%{+yyyy.MM.dd}"
 
 path.home: /opt/filebeat
+path.data: /var/log/vault/es-audit
 
 setup.template.enabled: true
 setup.template.name: "vault-audit"