Hi Stephen,
These logs are from the offline installation, this is what I get as output when I completely comment out the options within elasticsearch.yml:
[2023-03-24T17:17:54,495][INFO ][o.e.n.Node ] [WXTASK2P] version[8.6.2], pid[4604], build[zip/2d58d0f136141f03239816a4e360a8d17b6d8f29/2023-02-13T09:35:20.314882762Z], OS[Windows Server 2016/10.0/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/19.0.2/19.0.2+7-44]
[2023-03-24T17:17:54,495][INFO ][o.e.n.Node ] [WXTASK2P] JVM home [C:\_Mon\e\jdk], using bundled JDK [true]
[2023-03-24T17:17:54,495][INFO ][o.e.n.Node ] [WXTASK2P] JVM arguments [-Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -Djava.security.manager=allow, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j2.formatMsgNoLookups=true, -Djava.locale.providers=SPI,COMPAT, --add-opens=java.base/java.io=ALL-UNNAMED, -XX:+UseG1GC, -Djava.io.tmpdir=C:\Users\273872a\AppData\Local\Temp\elasticsearch, -XX:+HeapDumpOnOutOfMemoryError, -XX:+ExitOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Xms8191m, -Xmx8191m, -XX:MaxDirectMemorySize=4294967296, -XX:InitiatingHeapOccupancyPercent=30, -XX:G1ReservePercent=25, -Des.distribution.type=zip, --module-path=C:\_Mon\e\lib, --add-modules=jdk.net, -Djdk.module.main=org.elasticsearch.server]
[2023-03-24T17:17:56,386][INFO ][c.a.c.i.j.JacksonVersion ] [WXTASK2P] Package versions: jackson-annotations=2.13.2, jackson-core=2.13.2, jackson-databind=2.13.2.2, jackson-dataformat-xml=2.13.2, jackson-datatype-jsr310=2.13.2, azure-core=1.27.0, Troubleshooting version conflicts: https://aka.ms/azsdk/java/dependency/troubleshoot
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [aggregations]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [aggs-matrix-stats]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [analysis-common]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [apm]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [constant-keyword]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [data-streams]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [frozen-indices]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [ingest-attachment]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [ingest-common]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [ingest-geoip]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [ingest-user-agent]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [kibana]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [lang-expression]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [lang-mustache]
[2023-03-24T17:17:57,823][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [lang-painless]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [legacy-geo]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [mapper-extras]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [mapper-version]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [old-lucene-versions]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [parent-join]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [percolator]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [rank-eval]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [reindex]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [repositories-metering-api]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [repository-azure]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [repository-encrypted]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [repository-gcs]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [repository-s3]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [repository-url]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [runtime-fields-common]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [search-business-rules]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [searchable-snapshots]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [snapshot-based-recoveries]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [snapshot-repo-test-kit]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [spatial]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [transform]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [transport-netty4]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [unsigned-long]
[2023-03-24T17:17:57,839][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [vector-tile]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [wildcard]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-aggregate-metric]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-analytics]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-async]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-async-search]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-autoscaling]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-ccr]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-core]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-deprecation]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-enrich]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-eql]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-fleet]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-graph]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-identity-provider]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-ilm]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-logstash]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-ml]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-monitoring]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-ql]
[2023-03-24T17:17:57,855][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-rollup]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-security]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-shutdown]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-sql]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-stack]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-text-structure]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-voting-only-node]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-watcher]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] loaded module [x-pack-write-load-forecaster]
[2023-03-24T17:17:57,870][INFO ][o.e.p.PluginsService ] [WXTASK2P] no plugins loaded
[2023-03-24T17:18:00,121][INFO ][o.e.e.NodeEnvironment ] [WXTASK2P] using [1] data paths, mounts [[System (C:)]], net usable_space [68.8gb], net total_space [99gb], types [NTFS]
[2023-03-24T17:18:00,121][INFO ][o.e.e.NodeEnvironment ] [WXTASK2P] heap size [8gb], compressed ordinary object pointers [true]
[2023-03-24T17:18:00,214][INFO ][o.e.n.Node ] [WXTASK2P] node name [WXTASK2P], node ID [7vpxcuN-Rn6RRaO0sdjglQ], cluster name [elasticsearch], roles [data, remote_cluster_client, master, data_warm, data_content, transform, data_hot, ml, data_frozen, ingest, data_cold]
[2023-03-24T17:18:02,324][INFO ][o.e.i.g.DatabaseNodeService] [WXTASK2P] deleting stale file [C:\Users\273872a\AppData\Local\Temp\elasticsearch\geoip-databases\7vpxcuN-Rn6RRaO0sdjglQ\GeoLite2-Country.mmdb]
[2023-03-24T17:18:02,543][INFO ][o.e.x.s.Security ] [WXTASK2P] Security is enabled
[2023-03-24T17:18:02,830][INFO ][o.e.x.s.a.s.FileRolesStore] [WXTASK2P] parsed [0] roles from file [C:\_Mon\e\config\roles.yml]
[2023-03-24T17:18:03,270][INFO ][o.e.x.m.p.l.CppLogMessageHandler] [WXTASK2P] [controller/2268] [Main.cc@123] controller (64 bit): Version 8.6.2 (Build 0d41528b670ce1) Copyright (c) 2023 Elasticsearch BV
[2023-03-24T17:18:03,885][INFO ][o.e.t.n.NettyAllocator ] [WXTASK2P] creating NettyAllocator with the following configs: [name=elasticsearch_configured, chunk_size=1mb, suggested_max_allocation_size=1mb, factors={es.unsafe.use_netty_default_chunk_and_page_size=false, g1gc_enabled=true, g1gc_region_size=4mb}]
[2023-03-24T17:18:03,917][INFO ][o.e.i.r.RecoverySettings ] [WXTASK2P] using rate limit [40mb] with [default=40mb, read=0b, write=0b, max=0b]
[2023-03-24T17:18:03,948][INFO ][o.e.d.DiscoveryModule ] [WXTASK2P] using discovery type [multi-node] and seed hosts providers [settings]
[2023-03-24T17:18:04,956][INFO ][o.e.n.Node ] [WXTASK2P] initialized
[2023-03-24T17:18:04,956][INFO ][o.e.n.Node ] [WXTASK2P] starting ...
[2023-03-24T17:18:04,972][INFO ][o.e.x.s.c.f.PersistentCache] [WXTASK2P] persistent cache index loaded
[2023-03-24T17:18:04,972][INFO ][o.e.x.d.l.DeprecationIndexingComponent] [WXTASK2P] deprecation component started
[2023-03-24T17:18:05,066][INFO ][o.e.t.TransportService ] [WXTASK2P] publish_address {127.0.0.1:9300}, bound_addresses {127.0.0.1:9300}, {[::1]:9300}
[2023-03-24T17:18:05,349][WARN ][o.e.b.BootstrapChecks ] [WXTASK2P] the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
[2023-03-24T17:18:05,349][WARN ][o.e.b.BootstrapChecks ] [WXTASK2P] Transport SSL must be enabled if security is enabled. Please set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false]
[2023-03-24T17:18:05,349][INFO ][o.e.c.c.ClusterBootstrapService] [WXTASK2P] this node is locked into cluster UUID [3i5R-q4IRlebuDTiQrmZGA] and will not attempt further cluster bootstrapping
[2023-03-24T17:18:05,365][INFO ][o.e.c.c.ClusterBootstrapService] [WXTASK2P] no discovery configuration found, will perform best-effort cluster bootstrapping after [3s] unless existing master is discovered
[2023-03-24T17:18:05,470][INFO ][o.e.c.s.MasterService ] [WXTASK2P] elected-as-master ([1] nodes joined)[_FINISH_ELECTION_, {WXTASK2P}{7vpxcuN-Rn6RRaO0sdjglQ}{GmDqWG80Rr2I1xNqCXL8ig}{WXTASK2P}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw} completing election], term: 19, version: 164, delta: master node changed {previous [], current [{WXTASK2P}{7vpxcuN-Rn6RRaO0sdjglQ}{GmDqWG80Rr2I1xNqCXL8ig}{WXTASK2P}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}]}
[2023-03-24T17:18:05,533][INFO ][o.e.c.s.ClusterApplierService] [WXTASK2P] master node changed {previous [], current [{WXTASK2P}{7vpxcuN-Rn6RRaO0sdjglQ}{GmDqWG80Rr2I1xNqCXL8ig}{WXTASK2P}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}]}, term: 19, version: 164, reason: Publication{term=19, version=164}
[2023-03-24T17:18:05,580][INFO ][o.e.r.s.FileSettingsService] [WXTASK2P] starting file settings watcher ...
[2023-03-24T17:18:05,595][INFO ][o.e.r.s.FileSettingsService] [WXTASK2P] file settings service up and running [tid=65]
[2023-03-24T17:18:05,611][INFO ][o.e.h.AbstractHttpServerTransport] [WXTASK2P] publish_address {127.0.0.1:9200}, bound_addresses {127.0.0.1:9200}, {[::1]:9200}
[2023-03-24T17:18:05,611][INFO ][o.e.n.Node ] [WXTASK2P] started {WXTASK2P}{7vpxcuN-Rn6RRaO0sdjglQ}{GmDqWG80Rr2I1xNqCXL8ig}{WXTASK2P}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{xpack.installed=true, ml.allocated_processors_double=4.0, ml.max_jvm_size=8589934592, ml.allocated_processors=4, ml.machine_memory=17178836992}
[2023-03-24T17:18:05,673][INFO ][o.e.l.LicenseService ] [WXTASK2P] license [d70fc3bc-3e2a-4656-b864-1518ff7faafc] mode [basic] - valid
[2023-03-24T17:18:05,679][INFO ][o.e.x.s.a.Realms ] [WXTASK2P] license mode is [basic], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]
[2023-03-24T17:18:05,684][INFO ][o.e.g.GatewayService ] [WXTASK2P] recovered [2] indices into cluster_state
[2023-03-24T17:18:05,983][INFO ][o.e.h.n.s.HealthNodeTaskExecutor] [WXTASK2P] Node [{WXTASK2P}{7vpxcuN-Rn6RRaO0sdjglQ}] is selected as the current health node.
[2023-03-24T17:18:05,983][ERROR][o.e.i.g.GeoIpDownloader ] [WXTASK2P] exception during geoip databases updateorg.elasticsearch.ElasticsearchException: not all primary shards of [.geoip_databases] index are active
at org.elasticsearch.ingest.geoip@8.6.2/org.elasticsearch.ingest.geoip.GeoIpDownloader.updateDatabases(GeoIpDownloader.java:134)
at org.elasticsearch.ingest.geoip@8.6.2/org.elasticsearch.ingest.geoip.GeoIpDownloader.runDownloader(GeoIpDownloader.java:274)
at org.elasticsearch.ingest.geoip@8.6.2/org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:102)
at org.elasticsearch.ingest.geoip@8.6.2/org.elasticsearch.ingest.geoip.GeoIpDownloaderTaskExecutor.nodeOperation(GeoIpDownloaderTaskExecutor.java:48)
at org.elasticsearch.server@8.6.2/org.elasticsearch.persistent.NodePersistentTasksExecutor$1.doRun(NodePersistentTasksExecutor.java:42)
See logs for more details.
[2023-03-24T17:18:06,028][INFO ][o.e.c.r.a.AllocationService] [WXTASK2P] current.health="GREEN" message="Cluster health status changed from [RED] to [GREEN] (reason: [shards started [[.security-7][0]]])." previous.health="RED" reason="shards started [[.security-7][0]]"
[2023-03-24T17:18:06,169][INFO ][o.e.i.g.DatabaseNodeService] [WXTASK2P] successfully loaded geoip database file [GeoLite2-Country.mmdb]
At this point the installation program stops and doesn´t continue.
Actually I only want to install Winlogbeat. I need the offline installation of Elasticsearch as a base. However, as I wrote, I don´t have internet permission and cannot use the cloud option.
I thought with the manual download of the geoip file I might have more success
