Assuming you're using the official elasticsearch image, the Elasticsearch data directory will be a volume (mind the VOLUME /usr/share/elasticsearch/data statement in that image's Dockerfile).
You can now start another container, mounting your original container's volumes using the --volumes-from option to perform whatever cleanup tasks you deem necessary:
docker run --rm -it \
--volumes-from=<original-elasticsearch-container> \
ubuntu:latest \
/bin/bash
If that should fail, you can also run docker inspect on your Elasticsearch container and find the volume's directory in the host filesystem (assuming you're using the default local volume driver). Look for a Mounts section in the JSON output:
"Mounts": [
{
"Name": "<volume-id>",
"Source": "/var/lib/docker/volumes/<volume-id>/_data",
"Destination": "/usr/share/elasticsearch/data",
"Driver": "local",
"Mode": "",
"RW": true,
"Propagation": ""
}
],
The "Source" property will describe the volume's location on your host filesystem. When the container is started, this directory is simply bindmounted into the container's mount namespace; any changes you make in this directory on the host will be reflected in the container when it is started.