WIN
Elastic Agent - Windows
Elastic NVAgent logs
%PROGRAMFILES%\Elastic\Agent\data\elastic-agent-*\logs\- elastic-agent-YYYYMMDD.ndjsonElastic Agent
3 log locations · Windows, Linux
Where Elastic Agent keeps its logs
Elastic Agent logs to %PROGRAMFILES%\Elastic\Agent\data\elastic-agent-*\logs\ on Windows.
Elastic Agent logs to /var/lib/elastic-agent/data/elastic-agent-*/logs/elastic-agent.ndjson on Linux. 1 other Linux log location is recorded below, including paths for deb/rpm install and tar install.
Paths are printed exactly as Elastic Agent writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.
LNX
Agent log
/var/lib/elastic-agent/data/elastic-agent-*/logs/elastic-agent.ndjsonLNX
Agent log
/opt/Elastic/Agent/data/elastic-agent-*/logs/elastic-agent.ndjson