# Elasticsearch first time run hangs adding index template

**URL:** <https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169>\
**Category:** Elasticsearch\
**Tags:** windows\
**Created:** [December 12, 2023, 3:28pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169 "2023-12-12T15:28:16Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 3:28pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/1 "2023-12-12T15:28:16Z")

</div>

Hi,  
Using the unzip install method. Unzip, run elasticsearch.bat and it seems to be hanging at [o.e.c.m.MetadataIndexTemplateService] adding index template [logs] for index patterns [logs-_-_] for hours. I was expecting the install to finish and show me the elastic auto generated password. Prior to this point everything seems fine.  
Machine is a VM with 6 processors/16GB RAM. Task manager shows barely any activity at all. OS is Windows Server 2022 Standard.

Thanks!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2023, 3:41pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/2 "2023-12-12T15:41:28Z")

</div>

Hi @MColeman

> [@MColeman](#):
>
> Using the unzip install method

What version?

Are you running per [these docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/zip-windows.html#windows-running)

Are you running in the foreground or installing as a service?

The whole initial run should take just a couple mins...

Of course Elasticsearch will try to claim 8GB ram for VM unless you set jvm.options

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 3:53pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/3 "2023-12-12T15:53:31Z")

</div>

Hi Stephen!  
Version 8.11.0 - looks like 8.11.3 is out though so let me try it instead. I was using those docs.  
Let me try 8.11.3 and see if it's any different.

Thanks!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2023, 4:05pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/4 "2023-12-12T16:05:10Z")

</div>

Clean out the data directory.

And are you running in the foreground or service... I would run in the foreground first.

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 4:11pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/5 "2023-12-12T16:11:00Z")

</div>

Ok. I deleted everything to start over. Running foreground first from an admin command prompt. I went ahead and grabbed the new Kibana and logstash as well.  
The ultimate goal is to migrate our existing ELK stack off Centos and onto a Windows cluster.

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 4:27pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/6 "2023-12-12T16:27:55Z")

</div>

Ok, using 8.11.3 - hangs at the same place. Running in the foreground from an admin command prompt.

```auto
[2023-12-12T11:19:39,319][INFO][o.e.c.m.MetadataIndexTemplateService] [USNCA1MAMS162] adding index template [behavioral_analytics-events-default] for index patterns [behavioral_analytics-events-*]
[2023-12-12T11:19:39,381][INFO][o.e.x.i.a.TransportPutLifecycleAction] [USNCA1MAMS162] adding index lifecycle policy [.fleet-file-fromhost-meta-ilm-policy]
[2023-12-12T11:19:39,460][INFO][o.e.x.i.a.TransportPutLifecycleAction] [USNCA1MAMS162] adding index lifecycle policy [.deprecation-indexing-ilm-policy]
[2023-12-12T11:19:39,522][INFO][o.e.x.i.a.TransportPutLifecycleAction] [USNCA1MAMS162] adding index lifecycle policy [.fleet-file-tohost-meta-ilm-policy]
[2023-12-12T11:19:39,585][INFO][o.e.x.i.a.TransportPutLifecycleAction] [USNCA1MAMS162] adding index lifecycle policy [.fleet-file-fromhost-data-ilm-policy]
[2023-12-12T11:19:39,663][INFO][o.e.x.i.a.TransportPutLifecycleAction] [USNCA1MAMS162] adding index lifecycle policy [.fleet-actions-results-ilm-policy]
[2023-12-12T11:19:39,711][INFO][o.e.x.i.a.TransportPutLifecycleAction] [USNCA1MAMS162] adding index lifecycle policy [.fleet-file-tohost-data-ilm-policy]
[2023-12-12T11:19:39,917][INFO][o.e.h.n.s.HealthNodeTaskExecutor] [USNCA1MAMS162] Node [{USNCA1MAMS162}{h06NPO49SwmyBFDS-Uf_cA}] is selected as the current health node.
[2023-12-12T11:19:40,060][INFO][o.e.l.ClusterStateLicenseService] [USNCA1MAMS162] license [e84e8cd9-d41c-49c5-a39b-58f062f24ef1] mode [basic] - valid
[2023-12-12T11:19:40,060][INFO][o.e.x.s.a.Realms] [USNCA1MAMS162] license mode is [basic], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]
[2023-12-12T11:19:40,139][INFO][o.e.x.c.t.IndexTemplateRegistry] [USNCA1MAMS162] adding ingest pipeline logs-default-pipeline
[2023-12-12T11:19:40,139][INFO][o.e.c.m.MetadataIndexTemplateService] [USNCA1MAMS162] adding component template [logs-settings]
[2023-12-12T11:19:40,218][INFO][o.e.c.m.MetadataIndexTemplateService] [USNCA1MAMS162] adding index template [logs] for index patterns [logs-*-*]

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2023, 4:30pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/7 "2023-12-12T16:30:21Z")

</div>

hmmmm....and you are sure the endpoint is not up and running

I don't have a windows box handy I will check on my Mac see what comes after that step.

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 4:37pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/8 "2023-12-12T16:37:35Z")

</div>

[http://localhost:9200](http://localhost:9200) opens a username/password dialog, but the install has never shown me the elastic password. This is a fresh VM, nothing else on it

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 4:39pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/9 "2023-12-12T16:39:25Z")

</div>

It looks like it's elasticsearch if I cancel on the authentication dialog

```auto
{
    "error": {
        "root_cause": [
            {
                "type": "security_exception",
                "reason": "missing authentication credentials for REST request [/]",
                "header": {
                    "WWW-Authenticate": [
                        "Basic realm=\"security\" charset=\"UTF-8\"",
                        "ApiKey"
                    ]
                }
            }
        ],
        "type": "security_exception",
        "reason": "missing authentication credentials for REST request [/]",
        "header": {
            "WWW-Authenticate": [
                "Basic realm=\"security\" charset=\"UTF-8\"",
                "ApiKey"
            ]
        }
    },
    "status": 401
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2023, 4:47pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/10 "2023-12-12T16:47:12Z")

</div>

Interesting... you could try to reset the password.... but something does not seem right, I will not be able to look at this until later...

But it looks like elasticsearch is running...

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 5:14pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/11 "2023-12-12T17:14:39Z")

</div>

Thanks for the help! No rush. I'm out the rest of the week

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2023, 5:24pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/12 "2023-12-12T17:24:50Z")

</div>

And you are just running in the foreground? not as a service correct?

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 6:06pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/13 "2023-12-12T18:06:09Z")

</div>

Correct - Here are my steps:  
Unzip the downloaded zip file  
Take the extracted directory and copy it to the root of the drive (E: or F: - I've tried two different drives)  
rename the directory to just elasticsearch  
open admin command prompt  
cd e:\elasticsearch\bin  
elasticsearch.bat

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2023, 6:26pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/14 "2023-12-12T18:26:06Z")

</div>

Oddly enough I think you should run

```auto
cd e:\elasticsearch
.\bin\elasticsearch.bat

```

I think the relative directory may be important....

---

<div class="post-metadata">

**Author:** ![MColeman](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@MColeman](https://discuss.elastic.co/u/MColeman)\
**Post date:** [December 12, 2023, 7:42pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/15 "2023-12-12T19:42:23Z")

</div>

You won't believe it but I did it this way and it worked fine:  
unzip the zip file  
moved the elasticsearch-8.11.3 directory to the root of the E drive  
opened a normal command prompt - not admin  
cd E:\elasticsearch-8.11.3  
.\bin\elasticsearch.bat

Completed in less than a minute

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 12, 2023, 7:49pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/16 "2023-12-12T19:49:47Z")

</div>

heheheh sometimes we get lucky, and it _is_ just the simple things.

Yeah it is because it finds the other config files relatively..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2024, 7:50pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169/17 "2024-01-09T19:50:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.