# Elasticsearch don't run elasticsearch as root **URL:** \ **Category:** Elasticsearch\ **Created:** [January 30, 2017, 4:23am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152 "2017-01-30T04:23:15Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Me\_Cloud](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Post date:** [January 30, 2017, 4:23am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/1 "2017-01-30T04:23:15Z")
hello, i confused how to how to make don't run elasticsearch as root ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 30, 2017, 6:55am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/2 "2017-01-30T06:55:17Z")
How are you starting Elasticsearch right now? ---
**Author:** ![Me\_Cloud](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Post date:** [February 1, 2017, 5:29am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/3 "2017-02-01T05:29:15Z")
[root@ELK-5 admin-elk]# systemctl restart elasticsearch [root@ELK-5 admin-elk]# systemctl status elasticsearch ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2017-02-01 05:28:40 UTC; 10s ago Docs: [http://www.elastic.co](http://www.elastic.co) Process: 20880 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID\_DIR}/elasticsearch.pid --quiet -Edefault.path.logs=${LOG\_DIR} -Edefault.path.data=${DATA\_DIR} -Edefault.path.conf=${CONF\_DIR} (code=exited, status=1/FAILURE) Process: 20879 ExecStartPre=/usr/share/elasticsearch/bin/elasticsearch-systemd-pre-exec (code=exited, status=0/SUCCESS) Main PID: 20880 (code=exited, status=1/FAILURE) Feb 01 05:28:35 ELK-5 systemd[1]: Starting Elasticsearch... Feb 01 05:28:35 ELK-5 systemd[1]: Started Elasticsearch. Feb 01 05:28:40 ELK-5 systemd[1]: elasticsearch.service: main process exite...RE Feb 01 05:28:40 ELK-5 systemd[1]: Unit elasticsearch.service entered failed...e. Feb 01 05:28:40 ELK-5 systemd[1]: elasticsearch.service failed. Hint: Some lines were ellipsized, use -l to show in full. [root@ELK-5 admin-elk]# ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 1, 2017, 6:56am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/4 "2017-02-01T06:56:16Z")
Please show the error message you get in the Elasticsearch log. What's the value of the ES\_USER setting in /etc/default/elasticsearch? ---
**Author:** ![Me\_Cloud](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Post date:** [February 2, 2017, 8:21am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/5 "2017-02-02T08:21:46Z")
[2017-02-02T15:20:55,412][WARN][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:125) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.cli.SettingCommand.execute(SettingCommand.java:54) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.cli.Command.main(Command.java:88) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:89) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:82) ~[elasticsearch-5.1.2.jar:5.1.2] Caused by: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:100) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:176) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:306) ~[elasticsearch-5.1.2.jar:5.1.2] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-5.1.2.jar:5.1.2] ... 6 more there isn't /etc/default/elasticsearch ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 2, 2017, 8:26am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/6 "2017-02-02T08:26:47Z")
Which Linux distribution? ---
**Author:** ![Me\_Cloud](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Post date:** [February 2, 2017, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/7 "2017-02-02T08:34:43Z")
> [@magnusbaeck](#): > > Which Linux distribution? i used centos 7.2 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 2, 2017, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/8 "2017-02-02T08:35:55Z")
Oh. Then it's /etc/sysconfig/elasticsearch, not /etc/default/elasticsearch. [https://www.elastic.co/guide/en/elasticsearch/reference/master/rpm.html#rpm-configuring](https://www.elastic.co/guide/en/elasticsearch/reference/master/rpm.html#rpm-configuring) ---
**Author:** ![Me\_Cloud](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Post date:** [February 2, 2017, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/9 "2017-02-02T08:39:56Z")
#ES\_USER=elasticsearch #ES\_GROUP=elasticsearch ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 2, 2017, 8:40am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/10 "2017-02-02T08:40:53Z")
Weird. Then I don't know what's up. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 2, 2017, 8:41am UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/11 "2017-02-02T08:41:51Z")
Wait. Does /etc/sysconfig/elasticsearch _actually_ say this: ``` # ES_USER=elasticsearch # ES_GROUP=elasticsearch ``` If yes, try uncommenting those lines. ---
**Author:** ![Me\_Cloud](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)\ **Post date:** [February 2, 2017, 12:57pm UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/12 "2017-02-02T12:57:26Z")
yes, I have tried. but elasticsearch still can't run. it was because I installed x-pack ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2017, 12:57pm UTC](https://discuss.elastic.co/t/elasticsearch-dont-run-elasticsearch-as-root/73152/13 "2017-03-02T12:57:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.