issue when is changed in elasticsearch


I am getting the following error when I change to /opt/elk,

java.lang.IllegalStateException: detected index data in [/var/lib/elasticsearch] where there should not be any; check the logs for details.

I fixed it by deleting nodes in /var/lib/elasticsearch and restarted elasticsearch.

But my question is, shall I delete /var/lib/elasticsearch directory to avoid future issues?

Please suggest me..


What version are you on?
Please show the complete error line.
Please show your configuration file.

Also we’ve renamed ELK to the Elastic Stack, otherwise Beats and APM feel left out! :wink:

Elasticsearch 5.5.1

[2017-11-11T18:31:53,983][ERROR][o.e.b.Bootstrap          ] Exception
java.lang.IllegalStateException: detected index data in [/var/lib/elasticsearch] where there should not be any; check the logs for details
        at org.elasticsearch.node.Node.checkForIndexDataInDefaultPathData( ~[elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.node.Node.<init>( ~[elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.node.Node.<init>( ~[elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>( ~[elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.bootstrap.Bootstrap.setup( ~[elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.bootstrap.Bootstrap.init( [elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.bootstrap.Elasticsearch.init( [elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.bootstrap.Elasticsearch.execute( [elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute( [elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling( [elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.cli.Command.main( [elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.bootstrap.Elasticsearch.main( [elasticsearch-5.5.1.jar:5.5.1]
        at org.elasticsearch.bootstrap.Elasticsearch.main( [elasticsearch-5.5.1.jar:5.5.1]
[2017-11-11T18:31:53,988][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [prod-coordinating-node] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: detected index data in [/var/lib/elasticsearch] where there should not be any; check the logs for details
"/opt/logs/prod.log" 392L, 53453C
# ----------------------------------- Paths ------------------------------------
# Path to directory where to store the data (separate multiple locations by comma):
# /opt/elk
# Path to log files:
path.logs: /opt/logs

For my project, I am exactly using Elasticsearc, Logstash, and Kibana. So I named it as ELK. :slight_smile:

It looks like you started Elasticsearch with the defaults and added data before changing the paths?

I am not ingesting any data to elasticsearch at this point. I am still in cluster build out phase and encountered this issue. One more thing to add, I have installed Kibana on the same node. That might have caused the issue because Kibana by default has an index named '.kibana'.

Also, I have read this issue is in elasticsearch 5.3.x and was fixed in further versions. Is this still an issue in 5.5.x too?

I remember that issue and I thought it has been fixed as well. Any chance you can try the same scenario with the latest elasticsearch version?

1 Like

I already tried with elasticsearch 5.5.1 and got this issue. When you say latest version, is it 5.6.4?


If you can reproduce it in 5.6, it might be worth opening an issue? Cc @jasontedor

You do not need to delete /var/lib/elasticsearch, only relocate any index data that you have there. The message you are seeing should only appear if there are indeed indices in /var/lib/elasticsearch. Are you saying that you're still getting this message even though that path is now free of index data? Can you confirm by providing the output of tree /var/lib/elasticsearch?

Hi David,

I am not working on 5.6 right now, but in future if I get the same issue, will definitely post the issue.


I am not getting this message after it is made free of index data.

Then this is behaving as expected.

Why would it have to send the error message even after specifying to a different location other than /var/lib/elasticsearch.

Is it because of Kibana default index? (I am running Kibana on the same node)

The problem is will still be set to /var/lib/elasticsearch and if there is index data there then the check trips.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.