# Elasticsearch does not start CentOS7

**URL:** <https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373>\
**Category:** Elasticsearch\
**Created:** [November 8, 2022, 1:13am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373 "2022-11-08T01:13:11Z")\
**Posts on this page:** 18\
**Page:** 2

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 1:40pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/21 "2022-11-09T13:40:50Z")

</div>

my elasticsearch.yml looks like this right now -  
cluster.name: my-application  
node.name: dlx-prd-dal-search-11-p  
path.data: /var/lib/elasticsearch  
path.logs: /var/log/elasticsearch  
bootstrap.memory\_lock: true  
network.host: 0.0.0.0  
http.port: 9200  
discovery.type: 'single-node'  
xpack.security.enabled: 'true'

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [November 9, 2022, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/22 "2022-11-09T13:55:03Z")

</div>

seem like you did not enable https in ES, try curl command with `http` instead of `https` in URL

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 9, 2022, 1:59pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/23 "2022-11-09T13:59:25Z")

</div>

So, you do not have https configured, you need then to make the request using http.

```auto
curl -X POST "http://your-es-host:9200/_security/service/elastic/kibana/credential/token/kibanatoken?pretty" -u elastic:PASSWORD

```

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 2:07pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/24 "2022-11-09T14:07:17Z")

</div>

run with http instead of https got output

```auto
{
  "error" : "no handler found for uri [/_security/service/elastic/kibana/credential/token/kibanatoken?pretty] and method [POST]"
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 9, 2022, 4:47pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/25 "2022-11-09T16:47:31Z")

</div>

> [@vassiliy.vins](#):
>
> cluster.name: my-application  
> node.name: dlx-prd-dal-search-11-p  
> path.data: /var/lib/elasticsearch  
> path.logs: /var/log/elasticsearch  
> bootstrap.memory\_lock: true  
> network.host: 0.0.0.0  
> http.port: 9200  
> discovery.type: 'single-node'  
> xpack.security.enabled: 'true'

Hi @vassiliy.vins

If you did the default install your elasticsearch.yml would not look like this...

Simple question do you want security or not... above is something in between.

Do you Want Authentication and TLS on HTTPS and Transport

If you want NO security I can show you how to do that.

Also if you installed with security then you are trying to reduce / change that it will cause problemts...

So starting from the beginning What are Trying to Do?

a) Install Elasticsearch 8.x with Default Security Enable : This Means Authentication and TLS on HTTPS and Transport Layers

b) Install Elasticsearch 8.x with No security : No Auth No TLS

Seems like you are trying to do something in between.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 4:51pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/26 "2022-11-09T16:51:18Z")

</div>

OK, let's do from the very beginning  
I removed previous installation and will go with new installation from scratch  
I want to have full security - after testing on test bed it will go to production so I will need full security

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/27 "2022-11-09T16:55:06Z")

</div>

I did  
yum remove elasticsearch  
yum remove kibana  
and deleted all inside the elasticsearch and kibana folders in /etc and /usr/share  
should I delete smth elase?

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 4:59pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/28 "2022-11-09T16:59:18Z")

</div>

created elasticsearch.repo and kibana.repo

```auto
[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

```

```auto
[kibana-8.x]
name=Kibana repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

```

I'm ready to install elasticsearch and kibana  
should I go or need to verify smth else?

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 5:24pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/29 "2022-11-09T17:24:47Z")

</div>

reinstalled elasticsearch and got message:

```auto
--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : r_rjljduM70YD27wPdrl

If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

Reset the password of the elastic built-in superuser with 
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

Generate an enrollment token for Kibana instances with 
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

Generate an enrollment token for Elasticsearch nodes with 
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 9, 2022, 9:07pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/30 "2022-11-09T21:07:12Z")

</div>

And?

> [@vassiliy.vins](#):
>
> and deleted all inside the elasticsearch and kibana folders in /etc and /usr/share  
> should I delete smth elase?

Yes you need to delete the data directory... if not that will cause issues...

**data** The location of the data files of each index / shard allocated on the node. `/var/lib/elasticsearch` `path.data`

So I suspect you are not cleaning up the data directory

I will do a quick fresh install on CentOS and see what I see.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/31 "2022-11-09T21:16:09Z")

</div>

actually I cleaned /var/lib both for elasticsearch and kibana .  
The message I provided exactly matches elasticsearch Docs after elasticsearch installation  
now the question is - should I run the commands on this output? for enrollment token for Kibana and for Elasticsearch nodes?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 9, 2022, 9:45pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/32 "2022-11-09T21:45:03Z")

</div>

Good Yes you want to

Start Elasticsearch  
` sudo systemctl start elasticsearch.service`

Run this (sudo I think is missing in the instructions)  
`sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana`

Keep the token, it is good for 30 mins.

Then install Kibana ...

change in kibana.yml, only change I made so I could reach Kibana from another machine.

`server.host: "0.0.0.0"`

Start Kibana  
` sudo systemctl start kibana.service`

Access Kibana in browser

Paste in the Enrollement Token

run per the docs

`/usr/share/kibana/bin/kibana-verification-code `

paste in the verification code and you should be good!

And you should be good to go!

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 9, 2022, 10:21pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/33 "2022-11-09T22:21:25Z")

</div>

Yes, everything works! thank you!!! now I can see message

```auto
n a production environment, it is recommended that you configure server.publicBaseUrl. 

```

should I change this ?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 10, 2022, 12:41am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/34 "2022-11-10T00:41:37Z")

</div>

Your Call Yes you can if you like. If you are going to assign a DNS name etc you can do it when you do that, if you leave it as is it is no harm.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 21, 2022, 3:44pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/35 "2022-11-21T15:44:29Z")

</div>

Hello!

could you provide a link in Docs to connect filebeat to logstash?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 21, 2022, 4:10pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/36 "2022-11-21T16:10:55Z")

</div>

Please open a new topic when you have questions on filebeat and logstash

> **[Configure the Logstash output | Filebeat Reference \[8.5\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html)**

> **[Use ingest pipelines for parsing | Logstash Reference \[8.5\] | Elastic](https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html)**

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [November 21, 2022, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/37 "2022-11-21T16:54:38Z")

</div>

OK thnx

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2022, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373/38 "2022-12-19T16:55:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/elasticsearch-does-not-start-centos7/318373.md?page=1)