Elastic search start service is failing

[Shradha_Bharti]

Hi
I am trying to install the elastic search 7.3.0 version in my centos server
when i m checking the status with systemctl status elasticsearch -l command
I am getting the below error
elasticsearch.service - Elasticsearch
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Mon 2019-11-04 11:32:17 UTC; 7s ago
Docs: http://www.elastic.co
Process: 30707 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE)
Main PID: 30707 (code=exited, status=1/FAILURE)

Nov 04 11:32:17 nt-e2e-elk.novalocal elasticsearch[30707]: 2019-11-04 11:32:16,653 main ERROR Unable to locate appender "index_indexing_slowlog_rolling_old" for logger config "index.indexing.slowlog.index"
Nov 04 11:32:17 nt-e2e-elk.novalocal elasticsearch[30707]: 2019-11-04 11:32:16,654 main ERROR Unable to locate appender "index_indexing_slowlog_rolling" for logger config "index.indexing.slowlog.index"
Nov 04 11:32:17 nt-e2e-elk.novalocal elasticsearch[30707]: 2019-11-04 11:32:16,654 main ERROR Unable to locate appender "audit_rolling" for logger config "org.elasticsearch.xpack.security.audit.logfile.LoggingAuditTrail"
Nov 04 11:32:17 nt-e2e-elk.novalocal elasticsearch[30707]: 2019-11-04 11:32:16,655 main ERROR Unable to locate appender "index_search_slowlog_rolling_old" for logger config "index.search.slowlog"
Nov 04 11:32:17 nt-e2e-elk.novalocal elasticsearch[30707]: 2019-11-04 11:32:16,655 main ERROR Unable to locate appender "index_search_slowlog_rolling" for logger config "index.search.slowlog"
Nov 04 11:32:17 nt-e2e-elk.novalocal elasticsearch[30707]: 2019-11-04 11:32:16,656 main ERROR Unable to locate appender "deprecation_rolling_old" for logger config "org.elasticsearch.deprecation"
Nov 04 11:32:17 nt-e2e-elk.novalocal elasticsearch[30707]: 2019-11-04 11:32:16,656 main ERROR Unable to locate appender "deprecation_rolling" for logger config "org.elasticsearch.deprecation"
Nov 04 11:32:17 nt-e2e-elk.novalocal systemd[1]: elasticsearch.service: main process exited, code=exited, status=1/FAILURE
Nov 04 11:32:17 nt-e2e-elk.novalocal systemd[1]: Unit elasticsearch.service entered failed state.
Nov 04 11:32:17 nt-e2e-elk.novalocal systemd[1]: elasticsearch.service failed.

[thom (Thom O'Connor)]

hi @Shradha_Bharti - I saw this error on Elasticsearch 7.4.2 on CentOS 7. I realized that the problem was being caused because /etc/elasticsearch/elasticsearch.yml was missing on my system (I had accidentally checked it into RCS without checking it back out again). Upon replacing /etc/elasticsearch/elasticsearch.yml again, "systemctl start elasticsearch.service" worked properly again. Perhaps that will work for you - good luck