# Elasticsearch Log4j File Producing an error

**URL:** <https://discuss.elastic.co/t/elasticsearch-log4j-file-producing-an-error/370623>\
**Category:** Elasticsearch\
**Created:** [November 15, 2024, 6:47pm UTC](https://discuss.elastic.co/t/elasticsearch-log4j-file-producing-an-error/370623 "2024-11-15T18:47:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ESuleman](https://avatars.discourse-cdn.com/v4/letter/e/f08c70/32.png) [@ESuleman](https://discuss.elastic.co/u/ESuleman)\
**Post date:** [November 15, 2024, 6:47pm UTC](https://discuss.elastic.co/t/elasticsearch-log4j-file-producing-an-error/370623/1 "2024-11-15T18:47:31Z")

</div>

Hello.

I have 3 cluster Elasticsearch node running on version 8.6.2- at the moment our nodes are constantly going down due to the errors taken from the log files below. Is anyone familiar with these messages?  
ERROR: Elasticsearch exited unexpectedly  
2024-11-15 13:49:28,182 main ERROR ECSJsonLayout contains an invalid element or attribute "pattern"  
2024-11-15 13:49:28,225 main ERROR ECSJsonLayout contains invalid attributes "pattern", "type\_name", "opensearchmessagefields"  
2024-11-15 13:49:28,233 main ERROR ECSJsonLayout contains an invalid element or attribute "pattern"  
2024-11-15 13:49:28,235 main ERROR ECSJsonLayout contains an invalid element or attribute "pattern"  
2024-11-15 13:49:28,239 main ERROR Unable to locate appender "console" for logger config "root"  
2024-11-15 13:49:28,239 main ERROR Unable to locate appender "rolling\_old" for logger config "root"

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [November 17, 2024, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-log4j-file-producing-an-error/370623/2 "2024-11-17T08:39:46Z")

</div>

> [@ESuleman](#):
>
> "opensearchmessagefields"

Looks like you're using OpenSearch? Although OpenSearch and Elasticsearch share some common ancestry, they diverged some time ago and are now rather different products. Nobody with much OpenSearch expertise reads these forums so you'd be better off asking on an OpenSearch-specific forum.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 17, 2024, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-log4j-file-producing-an-error/370623/3 "2024-11-17T10:13:11Z")

</div>

But the version seems to be 8.6.2. So may be there's a plugin or something which is not supported?

@ESuleman could you share the logs from the start and also explain a bit more your architecture?

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [November 17, 2024, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-log4j-file-producing-an-error/370623/4 "2024-11-17T10:43:59Z")

</div>

Hmm yeah good point, 8.6.2 is not an OpenSearch version number indeed. Still, I don't see how we could have something called `opensearchmessagefields` here without at least some cross-contamination from an OpenSearch installation.