first stab at volume_dirs for elasticsearch logs