# Elasticsearch wont run after adding Sintinl **URL:** \ **Category:** Elasticsearch\ **Created:** [November 14, 2018, 1:36pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675 "2018-11-14T13:36:52Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 1:36pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/1 "2018-11-14T13:36:52Z")
my elasticsearch wont completely start after adding plugin. The errors are related to the log4j2.properties file not finding something....... ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Active: active (running) since Wed 2018-11-14 08:25:14 EST; 10s ago Docs: [http://www.elastic.co](http://www.elastic.co) Main PID: 17942 (java) CGroup: /system.slice/elasticsearch.service ├─17942 /bin/java -Xms1g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+AlwaysPreTouch -Xss1... └─18000 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86\_64/bin/controller Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,094 main ERROR Null object returned for RollingFile in Appenders. Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,094 main ERROR Null object returned for RollingFile in Appenders. Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,095 main ERROR Null object returned for RollingFile in Appenders. Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,095 main ERROR Null object returned for RollingFile in Appenders. Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,095 main ERROR Null object returned for RollingFile in Appenders. Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,096 main ERROR Unable to locate appender "rolling" for logger config "root" Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,096 main ERROR Unable to locate appender "index\_indexing\_slowlog\_rolling" for logger con...log.index" Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,096 main ERROR Unable to locate appender "audit\_rolling" for logger config "org.elastics...uditTrail" Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,097 main ERROR Unable to locate appender "index\_search\_slowlog\_rolling" for logger confi...h.slowlog" Nov 14 08:25:19 elasticsearch[17942]: 2018-11-14 08:25:19,097 main ERROR Unable to locate appender "deprecation\_rolling" for logger config "org.el...precation" ---
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 1:39pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/2 "2018-11-14T13:39:45Z")
status = error # log action execution errors for easier debugging logger.action.name = org.elasticsearch.action logger.action.level = debug appender.console.type = Console appender.console.name = console appender.console.layout.type = PatternLayout appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n appender.rolling.type = RollingFile appender.rolling.name = rolling appender.rolling.fileName = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}.log appender.rolling.layout.type = PatternLayout appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n appender.rolling.filePattern = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}-%d{yyyy-MM-dd}-%i.log.gz appender.rolling.policies.type = Policies appender.rolling.policies.time.type = TimeBasedTriggeringPolicy appender.rolling.policies.time.interval = 1 appender.rolling.policies.time.modulate = true appender.rolling.policies.size.type = SizeBasedTriggeringPolicy appender.rolling.policies.size.size = 128MB appender.rolling.strategy.type = DefaultRolloverStrategy appender.rolling.strategy.fileIndex = nomax appender.rolling.strategy.action.type = Delete appender.rolling.strategy.action.basepath = {sys:es.logs.base\_path} appender.rolling.strategy.action.condition.type = IfFileName appender.rolling.strategy.action.condition.glob = {sys:es.logs.cluster\_name}-\* appender.rolling.strategy.action.condition.nested\_condition.type = IfAccumulatedFileSize appender.rolling.strategy.action.condition.nested\_condition.exceeds = 2GB rootLogger.level = info rootLogger.appenderRef.console.ref = console rootLogger.appenderRef.rolling.ref = rolling appender.deprecation\_rolling.type = RollingFile appender.deprecation\_rolling.name = deprecation\_rolling appender.deprecation\_rolling.fileName = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_deprecation.log appender.deprecation\_rolling.layout.type = PatternLayout appender.deprecation\_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%.-10000m%n appender.deprecation\_rolling.filePattern = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_deprecation-%i.log.gz appender.deprecation\_rolling.policies.type = Policies appender.deprecation\_rolling.policies.size.type = SizeBasedTriggeringPolicy appender.deprecation\_rolling.policies.size.size = 1GB appender.deprecation\_rolling.strategy.type = DefaultRolloverStrategy appender.deprecation\_rolling.strategy.max = 4 logger.deprecation.name = org.elasticsearch.deprecation logger.deprecation.level = warn logger.deprecation.appenderRef.deprecation\_rolling.ref = deprecation\_rolling logger.deprecation.additivity = false appender.index\_search\_slowlog\_rolling.type = RollingFile appender.index\_search\_slowlog\_rolling.name = index\_search\_slowlog\_rolling appender.index\_search\_slowlog\_rolling.fileName = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_index\_search\_slowlog.log appender.index\_search\_slowlog\_rolling.layout.type = PatternLayout appender.index\_search\_slowlog\_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n appender.index\_search\_slowlog\_rolling.filePattern = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_index\_search\_slowlog-%d{yyyy-MM-dd}.log appender.index\_search\_slowlog\_rolling.policies.type = Policies appender.index\_search\_slowlog\_rolling.policies.time.type = TimeBasedTriggeringPolicy appender.index\_search\_slowlog\_rolling.policies.time.interval = 1 appender.index\_search\_slowlog\_rolling.policies.time.modulate = true logger.index\_search\_slowlog\_rolling.name = index.search.slowlog logger.index\_search\_slowlog\_rolling.level = trace logger.index\_search\_slowlog\_rolling.appenderRef.index\_search\_slowlog\_rolling.ref = index\_search\_slowlog\_rolling logger.index\_search\_slowlog\_rolling.additivity = false appender.index\_indexing\_slowlog\_rolling.type = RollingFile appender.index\_indexing\_slowlog\_rolling.name = index\_indexing\_slowlog\_rolling appender.index\_indexing\_slowlog\_rolling.fileName = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_index\_indexing\_slowlog.log appender.index\_indexing\_slowlog\_rolling.layout.type = PatternLayout appender.index\_indexing\_slowlog\_rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %marker%.-10000m%n appender.index\_indexing\_slowlog\_rolling.filePattern = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_index\_indexing\_slowlog-%d{yyyy-MM-dd}.log appender.index\_indexing\_slowlog\_rolling.policies.type = Policies appender.index\_indexing\_slowlog\_rolling.policies.time.type = TimeBasedTriggeringPolicy appender.index\_indexing\_slowlog\_rolling.policies.time.interval = 1 appender.index\_indexing\_slowlog\_rolling.policies.time.modulate = true logger.index\_indexing\_slowlog.name = index.indexing.slowlog.index logger.index\_indexing\_slowlog.level = trace logger.index\_indexing\_slowlog.appenderRef.index\_indexing\_slowlog\_rolling.ref = index\_indexing\_slowlog\_rolling logger.index\_indexing\_slowlog.additivity = false appender.audit\_rolling.type = RollingFile appender.audit\_rolling.name = audit\_rolling appender.audit\_rolling.fileName = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_access.log appender.audit\_rolling.layout.type = PatternLayout appender.audit\_rolling.layout.pattern = [%d{ISO8601}] %m%n appender.audit\_rolling.filePattern = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_access-%d{yyyy-MM-dd}.log appender.audit\_rolling.policies.type = Policies appender.audit\_rolling.policies.time.type = TimeBasedTriggeringPolicy appender.audit\_rolling.policies.time.interval = 1 appender.audit\_rolling.policies.time.modulate = true logger.xpack\_security\_audit\_logfile.name = org.elasticsearch.xpack.security.audit.logfile.LoggingAuditTrail logger.xpack\_security\_audit\_logfile.level = info logger.xpack\_security\_audit\_logfile.appenderRef.audit\_rolling.ref = audit\_rolling logger.xpack\_security\_audit\_logfile.additivity = false logger.xmlsig.name = org.apache.xml.security.signature.XMLSignature logger.xmlsig.level = error logger.samlxml\_decrypt.name = org.opensaml.xmlsec.encryption.support.Decrypter logger.samlxml\_decrypt.level = fatal logger.saml2\_decrypt.name = org.opensaml.saml.saml2.encryption.Decrypter logger.saml2\_decrypt.level = fatal ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 14, 2018, 1:41pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/3 "2018-11-14T13:41:04Z")
Look in the Elasticsearch logs for clues. If you have installed a third party plugin, you may need to bring this up with the creators. ---
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 2:01pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/4 "2018-11-14T14:01:33Z")
how would i be able to start elasticsearch as root that will be a good way to debug it ---
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 2:04pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/5 "2018-11-14T14:04:00Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f6009b27388208b66de9787f56a46d815671757.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 14, 2018, 2:05pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/6 "2018-11-14T14:05:55Z")
Check that you are not running out of disk space. The error the Elasticsearch plugin shows can be an indication that you have exceeded the 05% threshold. ---
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 2:06pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/7 "2018-11-14T14:06:49Z")
the only error that i have is trying to start elasticsearch as root ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e70d504b989627212bf5e14ca71c9d435792c39.png) ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 14, 2018, 2:08pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/8 "2018-11-14T14:08:52Z")
You are [not allowed to run Elasticsearch as root](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/modules-scripting-security.html#_do_not_run_as_root). ---
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 2:15pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/9 "2018-11-14T14:15:17Z")
You may have to be a little specific....there is ample amount of space on pc ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a29267ee9807edd7e59f6a1f9c188a4f9fb3ae5.png) ---
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 2:16pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/10 "2018-11-14T14:16:39Z")
what is the best methodology for getting real time information....like running the binary service without having to run it as root ---
**Author:** ![Ralph\_Lawrence](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ralph_lawrence/32/67088_2.png) [@Ralph\_Lawrence](https://discuss.elastic.co/u/Ralph_Lawrence)\ **Post date:** [November 14, 2018, 2:22pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/11 "2018-11-14T14:22:07Z")
Still the same problem ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9eaf6d9b2122350842a56a1bdfb438e3df59d14d.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 15, 2018, 4:44am UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/12 "2018-11-15T04:44:16Z")
Please don't post pictures of text, they are difficult to read and some people may not be even able to see them. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 15, 2018, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/13 "2018-11-15T07:47:47Z")
I would recommend that you reach out to the creators of this plugin. There may not be many people here having experience with this plugin. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 13, 2018, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-wont-run-after-adding-sintinl/156675/14 "2018-12-13T07:47:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.