# Can't find my ES logs
**URL:** https://discuss.elastic.co/t/cant-find-my-es-logs/14017
**Category:** Elasticsearch
**Created:** [October 18, 2013, 3:32pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017 "2013-10-18T15:32:48Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@thealy](https://discuss.elastic.co/u/thealy)
#### Post date: [October 18, 2013, 3:32pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/1 "2013-10-18T15:32:48Z")
New guy running ES 0.90.3 on RedHat, with 7 nodes.
But on all my RedHat nodes, which are running fine apparently, there are no
logs being written in the directory specified in elasticsearch.yml
by path.logs: /elastic/logs. I also see logs created in
/var/log/elasticsearch/ from the date of install, but they are not being
appended to. My Ubuntu nodes are logging fine to the configured directory.
What am I doing wrong?
-Terry
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 18, 2013, 9:37pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/2 "2013-10-18T21:37:20Z")
Per
> **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)**
>
> Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today.
If you have "path.log: /elastic/logs" then that is the directory it'll log
to, so you need to make sure it exists.
You are probably better off just leaving the default, which is
/var/log/elasticsearch.
Regards,
Mark Walkom
Infrastructure Engineer
Campaign Monitor
email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
On 19 October 2013 02:32, Terry Healy [thealy@bnl.gov](mailto:thealy@bnl.gov) wrote:
> New guy running ES 0.90.3 on RedHat, with 7 nodes.
>
> But on all my RedHat nodes, which are running fine apparently, there are
> no logs being written in the directory specified in elasticsearch.yml
> by path.logs: /elastic/logs. I also see logs created in
> /var/log/elasticsearch/ from the date of install, but they are not being
> appended to. My Ubuntu nodes are logging fine to the configured directory.
>
> What am I doing wrong?
>
> -Terry
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@Vishal\_Kapoor](https://discuss.elastic.co/u/Vishal_Kapoor)
#### Post date: [October 18, 2013, 9:52pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/3 "2013-10-18T21:52:59Z")
This is more generic troubleshooting tip, but you could look at the list of
open files elasticsearch process is holding.
once you know the pid, just do a
lsof -p | grep log
and you should be able to see the log file if you have the correct
permissions...
hope it helps.
Vishal
On Fri, Oct 18, 2013 at 4:37 PM, Mark Walkom [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)wrote:
> Per
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html)
> If you have "path.log: /elastic/logs" then that is the directory it'll
> log to, so you need to make sure it exists.
>
> You are probably better off just leaving the default, which is
> /var/log/elasticsearch.
>
> Regards,
> Mark Walkom
>
> Infrastructure Engineer
> Campaign Monitor
> email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
>
> On 19 October 2013 02:32, Terry Healy [thealy@bnl.gov](mailto:thealy@bnl.gov) wrote:
>
> > New guy running ES 0.90.3 on RedHat, with 7 nodes.
> >
> > But on all my RedHat nodes, which are running fine apparently, there are
> > no logs being written in the directory specified in elasticsearch.yml
> > by path.logs: /elastic/logs. I also see logs created in
> > /var/log/elasticsearch/ from the date of install, but they are not being
> > appended to. My Ubuntu nodes are logging fine to the configured directory.
> >
> > What am I doing wrong?
> >
> > -Terry
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@otisg](https://discuss.elastic.co/u/otisg)
#### Post date: [October 19, 2013, 2:01am UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/4 "2013-10-19T02:01:29Z")
Hi Terry,
My first 2 thoughts:
- directory write permission issue
- dir doesn't actually exist.
ls its parent.
## Otis
Solr & Elasticsearch Support -- [http://sematext.com/](http://sematext.com/)
Performance Monitoring -- [Sematext Monitoring | Infrastructure Monitoring Service](http://sematext.com/spm)
On Friday, October 18, 2013 11:32:48 AM UTC-4, Terry Healy wrote:
> New guy running ES 0.90.3 on RedHat, with 7 nodes.
>
> But on all my RedHat nodes, which are running fine apparently, there are
> no logs being written in the directory specified in elasticsearch.yml
> by path.logs: /elastic/logs. I also see logs created in
> /var/log/elasticsearch/ from the date of install, but they are not being
> appended to. My Ubuntu nodes are logging fine to the configured directory.
>
> What am I doing wrong?
>
> -Terry
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@thealy](https://discuss.elastic.co/u/thealy)
#### Post date: [October 21, 2013, 3:06pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/5 "2013-10-21T15:06:25Z")
Mark, Vishal, Otis: Thanks very much for taking the time to help me out.
I've trued to combine your suggested troublshooting actions, but still
seem to be stuck.
* * *
First, I tried lsof with the elasticsearch PID, but all it found was the
logging .jar file:
[root@hd60:~]# service elasticsearch status
elasticsearch (pid 24353) is running...
[root@hd60:~]# lsof -p 24353 | grep log
java 24353 elasticsearch mem REG 8,3 489884
396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
java 24353 elasticsearch 5r REG 8,3 489884
396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
* * *
My config says:
path.logs: /elastic1/logs
The referred to directory, which is empty, has these permissions /
ownership.
drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 18 10:37 logs
* * *
Looking in /var/log/elasticsearch, it was written to during in initial
install. After this I stopped it, set the clustername, host config, etc.
including the path.logs value above.
[root@hd60:/var/log]# ls -la /var/log/elasticsearch/
total 12
drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 17 16:52 .
drwxr-xr-x. 10 root root 4096 Oct 20 03:47 ..
-rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
elasticsearch\_index\_indexing\_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
elasticsearch\_index\_search\_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch 1674 Sep 17 17:05
elasticsearch.log
* * *
So I tried being very liberal with the permissions on /elastic1/logs,
and then restarting:
[root@hd60:/elastic1]# chmod -R a+wr logs
[root@hd60:/elastic1]# service elasticsearch restart
Stopping elasticsearch: [OK]
Starting elasticsearch: [OK]
[root@hd60:/elastic1]# log4j:WARN No appenders could be found for logger
(common.jna).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See [Apache log4j 1.2 - Frequently Asked Technical Questions](http://logging.apache.org/log4j/1.2/faq.html#noconfig) for
more info.
I have looked at the page referred to by the log4j error, but frankly I
do not understand what it is telling me to do.
-Terry
On 10/18/2013 05:52 PM, Vishal Kapoor wrote:
> This is more generic troubleshooting tip, but you could look at the list
> of open files elasticsearch process is holding.
> once you know the pid, just do a
> lsof -p | grep log
> and you should be able to see the log file if you have the correct
> permissions...
>
> hope it helps.
>
> Vishal
>
> On Fri, Oct 18, 2013 at 4:37 PM, Mark Walkom \<[markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> [mailto:markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)\> wrote:
>
> ```
> Per http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html
> If you have "path.log: /elastic/logs" then that is the directory
> it'll log to, so you need to make sure it exists.
>
> You are probably better off just leaving the default, which is
> /var/log/elasticsearch.
>
> Regards,
> Mark Walkom
>
> Infrastructure Engineer
> Campaign Monitor
> email: markw@campaignmonitor.com
> web: www.campaignmonitor.com
>
> On 19 October 2013 02:32, Terry Healy > wrote:
>
> New guy running ES 0.90.3 on RedHat, with 7 nodes.
>
> But on all my RedHat nodes, which are running fine apparently,
> there are no logs being written in the directory specified in
> elasticsearch.yml by path.logs: /elastic/logs. I also see logs
> created in /var/log/elasticsearch/ from the date of install, but
> they are not being appended to. My Ubuntu nodes are logging fine
> to the configured directory.
>
> What am I doing wrong?
>
> -Terry
>
> --
> You received this message because you are subscribed to the
> Google Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from
> it, send an email to elasticsearch+unsubscribe@googlegroups.com
> .
> For more options, visit https://groups.google.com/groups/opt_out.
>
> --
> You received this message because you are subscribed to the Google
> Groups "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it,
> send an email to elasticsearch+unsubscribe@googlegroups.com
> .
> For more options, visit https://groups.google.com/groups/opt_out.
>
> ```
>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "elasticsearch" group.
> To unsubscribe from this topic, visit
> [https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe](https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe).
> To unsubscribe from this group and all its topics, send an email to
> [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@thealy](https://discuss.elastic.co/u/thealy)
#### Post date: [October 21, 2013, 8:39pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/6 "2013-10-21T20:39:50Z")
The whole issue was that I had:
path.conf: /etc/elasticsearch/elasticsearch.yml
Instead of the correct:
path.conf: /etc/elasticsearch
Sorry to waste your time. On to the next problem...
-Terry
On 10/21/2013 11:06 AM, Terry Healy wrote:
> Mark, Vishal, Otis: Thanks very much for taking the time to help me out.
> I've trued to combine your suggested troublshooting actions, but still
> seem to be stuck.
>
> * * *
>
> First, I tried lsof with the elasticsearch PID, but all it found was the
> logging .jar file:
>
> [root@hd60:~]# service elasticsearch status
> elasticsearch (pid 24353) is running...
>
> [root@hd60:~]# lsof -p 24353 | grep log
>
> java 24353 elasticsearch mem REG 8,3 489884
> 396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
>
> java 24353 elasticsearch 5r REG 8,3 489884
> 396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
>
> * * *
>
> My config says:
>
> path.logs: /elastic1/logs
>
> The referred to directory, which is empty, has these permissions /
> ownership.
>
> drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 18 10:37 logs
>
> * * *
>
> Looking in /var/log/elasticsearch, it was written to during in initial
> install. After this I stopped it, set the clustername, host config, etc.
> including the path.logs value above.
>
> [root@hd60:/var/log]# ls -la /var/log/elasticsearch/
>
> total 12
> drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 17 16:52 .
>
> drwxr-xr-x. 10 root root 4096 Oct 20 03:47 ..
>
> -rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
> elasticsearch\_index\_indexing\_slowlog.log
>
> -rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
> elasticsearch\_index\_search\_slowlog.log
>
> -rw-r--r--. 1 elasticsearch elasticsearch 1674 Sep 17 17:05
> elasticsearch.log
>
> * * *
>
> So I tried being very liberal with the permissions on /elastic1/logs,
> and then restarting:
>
> [root@hd60:/elastic1]# chmod -R a+wr logs
>
> [root@hd60:/elastic1]# service elasticsearch restart
>
> Stopping elasticsearch: [OK]
> Starting elasticsearch: [OK]
> [root@hd60:/elastic1]# log4j:WARN No appenders could be found for logger
> (common.jna).
> log4j:WARN Please initialize the log4j system properly.
> log4j:WARN See [Apache log4j 1.2 - Frequently Asked Technical Questions](http://logging.apache.org/log4j/1.2/faq.html#noconfig) for
> more info.
>
> I have looked at the page referred to by the log4j error, but frankly I
> do not understand what it is telling me to do.
>
> -Terry
>
> On 10/18/2013 05:52 PM, Vishal Kapoor wrote:
>
> > This is more generic troubleshooting tip, but you could look at the list
> > of open files elasticsearch process is holding.
> > once you know the pid, just do a
> > lsof -p | grep log
> > and you should be able to see the log file if you have the correct
> > permissions...
> >
> > hope it helps.
> >
> > Vishal
> >
> > On Fri, Oct 18, 2013 at 4:37 PM, Mark Walkom \<[markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> > [mailto:markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)\> wrote:
> >
> > ```
> > Per http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html
> > If you have "path.log: /elastic/logs" then that is the directory
> > it'll log to, so you need to make sure it exists.
> >
> > You are probably better off just leaving the default, which is
> > /var/log/elasticsearch.
> >
> > Regards,
> > Mark Walkom
> >
> > Infrastructure Engineer
> > Campaign Monitor
> > email: markw@campaignmonitor.com
> > web: www.campaignmonitor.com
> >
> > On 19 October 2013 02:32, Terry Healy > > wrote:
> >
> > New guy running ES 0.90.3 on RedHat, with 7 nodes.
> >
> > But on all my RedHat nodes, which are running fine apparently,
> > there are no logs being written in the directory specified in
> > elasticsearch.yml by path.logs: /elastic/logs. I also see logs
> > created in /var/log/elasticsearch/ from the date of install, but
> > they are not being appended to. My Ubuntu nodes are logging fine
> > to the configured directory.
> >
> > What am I doing wrong?
> >
> > -Terry
> >
> > --
> > You received this message because you are subscribed to the
> > Google Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from
> > it, send an email to elasticsearch+unsubscribe@googlegroups.com
> > .
> > For more options, visit https://groups.google.com/groups/opt_out.
> >
> > --
> > You received this message because you are subscribed to the Google
> > Groups "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it,
> > send an email to elasticsearch+unsubscribe@googlegroups.com
> > .
> > For more options, visit https://groups.google.com/groups/opt_out.
> >
> > ```
> >
> > --
> > You received this message because you are subscribed to a topic in the
> > Google Groups "elasticsearch" group.
> > To unsubscribe from this topic, visit
> > [https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe](https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe).
> > To unsubscribe from this group and all its topics, send an email to
> > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 21, 2013, 9:49pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/7 "2013-10-21T21:49:21Z")
Is there any reason you are explicitly setting these rather than leaving
the implicit defaults?
Regards,
Mark Walkom
Infrastructure Engineer
Campaign Monitor
email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
On 22 October 2013 07:39, Terry Healy [thealy@bnl.gov](mailto:thealy@bnl.gov) wrote:
> The whole issue was that I had:
>
> path.conf: /etc/elasticsearch/elasticsearch.yml
>
> Instead of the correct:
>
> path.conf: /etc/elasticsearch
>
> Sorry to waste your time. On to the next problem...
>
> -Terry
>
> On 10/21/2013 11:06 AM, Terry Healy wrote:
>
> > Mark, Vishal, Otis: Thanks very much for taking the time to help me out.
> > I've trued to combine your suggested troublshooting actions, but still
> > seem to be stuck.
> >
> > * * *
> >
> > First, I tried lsof with the elasticsearch PID, but all it found was the
> > logging .jar file:
> >
> > [root@hd60:~]# service elasticsearch status
> > elasticsearch (pid 24353) is running...
> >
> > [root@hd60:~]# lsof -p 24353 | grep log
> >
> > java 24353 elasticsearch mem REG 8,3 489884
> > 396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
> >
> > java 24353 elasticsearch 5r REG 8,3 489884
> > 396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
> >
> > * * *
> >
> > My config says:
> >
> > path.logs: /elastic1/logs
> >
> > The referred to directory, which is empty, has these permissions /
> > ownership.
> >
> > drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 18 10:37 logs
> >
> > * * *
> >
> > Looking in /var/log/elasticsearch, it was written to during in initial
> > install. After this I stopped it, set the clustername, host config, etc.
> > including the path.logs value above.
> >
> > [root@hd60:/var/log]# ls -la /var/log/elasticsearch/
> >
> > total 12
> > drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 17 16:52 .
> >
> > drwxr-xr-x. 10 root root 4096 Oct 20 03:47 ..
> >
> > -rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
> > elasticsearch\_index\_indexing\_slowlog.log
> >
> > -rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
> > elasticsearch\_index\_search\_slowlog.log
> >
> > -rw-r--r--. 1 elasticsearch elasticsearch 1674 Sep 17 17:05
> > elasticsearch.log
> >
> > * * *
> >
> > So I tried being very liberal with the permissions on /elastic1/logs,
> > and then restarting:
> >
> > [root@hd60:/elastic1]# chmod -R a+wr logs
> >
> > [root@hd60:/elastic1]# service elasticsearch restart
> >
> > Stopping elasticsearch: [OK]
> > Starting elasticsearch: [OK]
> > [root@hd60:/elastic1]# log4j:WARN No appenders could be found for logger
> > (common.jna).
> > log4j:WARN Please initialize the log4j system properly.
> > log4j:WARN See [Apache log4j 1.2 - Frequently Asked Technical Questions](http://logging.apache.org/log4j/1.2/faq.html#noconfig) for
> > more info.
> >
> > I have looked at the page referred to by the log4j error, but frankly I
> > do not understand what it is telling me to do.
> >
> > -Terry
> >
> > On 10/18/2013 05:52 PM, Vishal Kapoor wrote:
> >
> > > This is more generic troubleshooting tip, but you could look at the list
> > > of open files elasticsearch process is holding.
> > > once you know the pid, just do a
> > > lsof -p | grep log
> > > and you should be able to see the log file if you have the correct
> > > permissions...
> > >
> > > hope it helps.
> > >
> > > Vishal
> > >
> > > On Fri, Oct 18, 2013 at 4:37 PM, Mark Walkom \<[markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> > > [mailto:markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)\> wrote:
> > >
> > > ```
> > > Per
> > >
> > > ```
>
> [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html)
>
> > > ```
> > > If you have "path.log: /elastic/logs" then that is the directory
> > > it'll log to, so you need to make sure it exists.
> > >
> > > You are probably better off just leaving the default, which is
> > > /var/log/elasticsearch.
> > >
> > > Regards,
> > > Mark Walkom
> > >
> > > Infrastructure Engineer
> > > Campaign Monitor
> > > email: markw@campaignmonitor.com
> > > web: www.campaignmonitor.com
> > >
> > > On 19 October 2013 02:32, Terry Healy > > > wrote:
> > >
> > > New guy running ES 0.90.3 on RedHat, with 7 nodes.
> > >
> > > But on all my RedHat nodes, which are running fine apparently,
> > > there are no logs being written in the directory specified in
> > > elasticsearch.yml by path.logs: /elastic/logs. I also see logs
> > > created in /var/log/elasticsearch/ from the date of install, but
> > > they are not being appended to. My Ubuntu nodes are logging fine
> > > to the configured directory.
> > >
> > > What am I doing wrong?
> > >
> > > -Terry
> > >
> > > --
> > > You received this message because you are subscribed to the
> > > Google Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from
> > > it, send an email to elasticsearch+unsubscribe@googlegroups.com
> > > .
> > > For more options, visit
> > >
> > > ```
>
> [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
>
> > > ```
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it,
> > > send an email to elasticsearch+unsubscribe@googlegroups.com
> > > .
> > > For more options, visit https://groups.google.com/groups/opt_out.
> > >
> > > ```
> > >
> > > --
> > > You received this message because you are subscribed to a topic in the
> > > Google Groups "elasticsearch" group.
> > > To unsubscribe from this topic, visit
> > > [https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe](https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe)
> > > .
> > > To unsubscribe from this group and all its topics, send an email to
> > > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@thealy](https://discuss.elastic.co/u/thealy)
#### Post date: [October 21, 2013, 10:07pm UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/8 "2013-10-21T22:07:43Z")
It just seemed reasonable to group them together. But this just made my
problem worse, so I guess this was a bad choice. Not my first....or last.
On Oct 21, 2013 5:49 PM, "Mark Walkom" [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com) wrote:
> Is there any reason you are explicitly setting these rather than leaving
> the implicit defaults?
>
> Regards,
> Mark Walkom
>
> Infrastructure Engineer
> Campaign Monitor
> email: [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> web: [www.campaignmonitor.com](http://www.campaignmonitor.com)
>
> On 22 October 2013 07:39, Terry Healy [thealy@bnl.gov](mailto:thealy@bnl.gov) wrote:
>
> > The whole issue was that I had:
> >
> > path.conf: /etc/elasticsearch/elasticsearch.yml
> >
> > Instead of the correct:
> >
> > path.conf: /etc/elasticsearch
> >
> > Sorry to waste your time. On to the next problem...
> >
> > -Terry
> >
> > On 10/21/2013 11:06 AM, Terry Healy wrote:
> >
> > > Mark, Vishal, Otis: Thanks very much for taking the time to help me out.
> > > I've trued to combine your suggested troublshooting actions, but still
> > > seem to be stuck.
> > >
> > > * * *
> > >
> > > First, I tried lsof with the elasticsearch PID, but all it found was the
> > > logging .jar file:
> > >
> > > [root@hd60:~]# service elasticsearch status
> > > elasticsearch (pid 24353) is running...
> > >
> > > [root@hd60:~]# lsof -p 24353 | grep log
> > >
> > > java 24353 elasticsearch mem REG 8,3 489884
> > > 396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
> > >
> > > java 24353 elasticsearch 5r REG 8,3 489884
> > > 396751 /usr/share/elasticsearch/lib/log4j-1.2.17.jar
> > >
> > > * * *
> > >
> > > My config says:
> > >
> > > path.logs: /elastic1/logs
> > >
> > > The referred to directory, which is empty, has these permissions /
> > > ownership.
> > >
> > > drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 18 10:37 logs
> > >
> > > * * *
> > >
> > > Looking in /var/log/elasticsearch, it was written to during in initial
> > > install. After this I stopped it, set the clustername, host config, etc.
> > > including the path.logs value above.
> > >
> > > [root@hd60:/var/log]# ls -la /var/log/elasticsearch/
> > >
> > > total 12
> > > drwxr-xr-x. 2 elasticsearch elasticsearch 4096 Sep 17 16:52 .
> > >
> > > drwxr-xr-x. 10 root root 4096 Oct 20 03:47 ..
> > >
> > > -rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
> > > elasticsearch\_index\_indexing\_slowlog.log
> > >
> > > -rw-r--r--. 1 elasticsearch elasticsearch 0 Sep 17 16:52
> > > elasticsearch\_index\_search\_slowlog.log
> > >
> > > -rw-r--r--. 1 elasticsearch elasticsearch 1674 Sep 17 17:05
> > > elasticsearch.log
> > >
> > > * * *
> > >
> > > So I tried being very liberal with the permissions on /elastic1/logs,
> > > and then restarting:
> > >
> > > [root@hd60:/elastic1]# chmod -R a+wr logs
> > >
> > > [root@hd60:/elastic1]# service elasticsearch restart
> > >
> > > Stopping elasticsearch: [OK]
> > > Starting elasticsearch: [OK]
> > > [root@hd60:/elastic1]# log4j:WARN No appenders could be found for
> > > logger
> > > (common.jna).
> > > log4j:WARN Please initialize the log4j system properly.
> > > log4j:WARN See [Apache log4j 1.2 - Frequently Asked Technical Questions](http://logging.apache.org/log4j/1.2/faq.html#noconfigfor)
> > > more info.
> > >
> > > I have looked at the page referred to by the log4j error, but frankly I
> > > do not understand what it is telling me to do.
> > >
> > > -Terry
> > >
> > > On 10/18/2013 05:52 PM, Vishal Kapoor wrote:
> > >
> > > > This is more generic troubleshooting tip, but you could look at the
> > > > list
> > > > of open files elasticsearch process is holding.
> > > > once you know the pid, just do a
> > > > lsof -p | grep log
> > > > and you should be able to see the log file if you have the correct
> > > > permissions...
> > > >
> > > > hope it helps.
> > > >
> > > > Vishal
> > > >
> > > > On Fri, Oct 18, 2013 at 4:37 PM, Mark Walkom \<
> > > > [markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)
> > > > [mailto:markw@campaignmonitor.com](mailto:markw@campaignmonitor.com)\> wrote:
> > > >
> > > > ```
> > > > Per
> > > >
> > > > ```
> >
> > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html)
> >
> > > > ```
> > > > If you have "path.log: /elastic/logs" then that is the directory
> > > > it'll log to, so you need to make sure it exists.
> > > >
> > > > You are probably better off just leaving the default, which is
> > > > /var/log/elasticsearch.
> > > >
> > > > Regards,
> > > > Mark Walkom
> > > >
> > > > Infrastructure Engineer
> > > > Campaign Monitor
> > > > email: markw@campaignmonitor.com > > >
> > > > ```
> > >
> > > > ```
> > > > web: www.campaignmonitor.com
> > > >
> > > > On 19 October 2013 02:32, Terry Healy > > > > wrote:
> > > >
> > > > New guy running ES 0.90.3 on RedHat, with 7 nodes.
> > > >
> > > > But on all my RedHat nodes, which are running fine apparently,
> > > > there are no logs being written in the directory specified in
> > > > elasticsearch.yml by path.logs: /elastic/logs. I also see logs
> > > > created in /var/log/elasticsearch/ from the date of install,
> > > >
> > > > ```
> >
> > but
> >
> > > > ```
> > > > they are not being appended to. My Ubuntu nodes are logging
> > > >
> > > > ```
> >
> > fine
> >
> > > > ```
> > > > to the configured directory.
> > > >
> > > > What am I doing wrong?
> > > >
> > > > -Terry
> > > >
> > > > --
> > > > You received this message because you are subscribed to the
> > > > Google Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from
> > > > it, send an email to
> > > >
> > > > ```
> >
> > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com)
> >
> > > > ```
> > > > .
> > > > For more options, visit
> > > >
> > > > ```
> >
> > [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
> >
> > > > ```
> > > > --
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it,
> > > > send an email to elasticsearch+unsubscribe@googlegroups.com
> > > > .
> > > > For more options, visit https://groups.google.com/groups/opt_out.
> > > >
> > > > ```
> > > >
> > > > --
> > > > You received this message because you are subscribed to a topic in the
> > > > Google Groups "elasticsearch" group.
> > > > To unsubscribe from this topic, visit
> >
> > [https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe](https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe).
> >
> > > > To unsubscribe from this group and all its topics, send an email to
> > > > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > > > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "elasticsearch" group.
> To unsubscribe from this topic, visit
> [https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe](https://groups.google.com/d/topic/elasticsearch/GmwkbGUG38w/unsubscribe).
> To unsubscribe from this group and all its topics, send an email to
> [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:11am UTC](https://discuss.elastic.co/t/cant-find-my-es-logs/14017/9 "2017-07-06T02:11:18Z")