# ES 5.2 log files not being written **URL:** \ **Category:** Elasticsearch\ **Created:** [December 19, 2018, 7:02pm UTC](https://discuss.elastic.co/t/es-5-2-log-files-not-being-written/161585 "2018-12-19T19:02:14Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![kwstx14](https://avatars.discourse-cdn.com/v4/letter/k/9e8a1a/32.png) [@kwstx14](https://discuss.elastic.co/u/kwstx14)\ **Post date:** [December 19, 2018, 7:02pm UTC](https://discuss.elastic.co/t/es-5-2-log-files-not-being-written/161585/1 "2018-12-19T19:02:14Z")
Logging is not working for us on Elasticsearch 5.2.0, and I can't find any documentation on the web that addresses the issue. Salient points: log4j2.properties makes use of a couple of "exposed" variables that weren't in earlier versions of the product. An example line from the file that makes use of sys:es.logs.base\_path and sys:es.logs.cluster\_name is > appender.rolling.fileName = ${sys:es.logs.base\_path}${sys:file.separator}${sys:es.logs.cluster\_name}.log The closest place I could find values that would be of use to log4j2 is in elasticsearch.yml, which defines both a log file path and a cluster name: > cluster.name: va\_cluster\_DDC\_Dev > path.data: "/data/elasticsearch/es-01" > path.logs: "/data/elasticsearch/logs/es-01" Log files should show up in /data/elasticsearch/logs/es-01, but they don't. But something strange I found is in /usr/share/elasticsearch: > [root@d03y07vemda0004 elasticsearch]# cd /usr/share/elasticsearch > [root@d03y07vemda0004 elasticsearch]# ls -lah > total 52K > drwxr-xr-x 9 elasticsearch elasticsearch 4.0K Nov 22 2017 . > drwxr-xr-x. 164 root root 4.0K Nov 22 2017 .. > drwxr-xr-x 2 root root 145 Nov 22 2017 bin > drwxr-xr-x 2 root root 4.0K Nov 22 2017 lib > -rw-r--r-- 1 root root 12K Jan 24 2017 LICENSE.txt > drwxr-xr-x 12 root root 4.0K Nov 22 2017 modules > -rw-r--r-- 1 root root 150 Jan 24 2017 NOTICE.txt > drwxr-xr-x 2 elasticsearch elasticsearch 6 Nov 22 2017 plugins > -rw-r--r-- 1 root root 8.9K Jan 24 2017 README.textile > drwxr-xr-x 2 elasticsearch elasticsearch 6 Nov 22 2017 scripts > drwxr-xr-x 2 elasticsearch elasticsearch 4.0K Nov 8 13:31 ${sys:es.logs.base\_path} > drwxr-xr-x 2 elasticsearch elasticsearch 6 Nov 22 2017 templates\_import > > ls -lah './${sys:es.logs.base\_path}' > total 40K > drwxr-xr-x 2 elasticsearch elasticsearch 4.0K Nov 8 13:31 . > drwxr-xr-x 9 elasticsearch elasticsearch 4.0K Nov 22 2017 .. > -rw-r--r-- 1 elasticsearch elasticsearch 3.8K Apr 16 2018 ${sys:es.logs.cluster\_name}-2018-03-10-1.log.gz > -rw-r--r-- 1 elasticsearch elasticsearch 3.4K Sep 24 09:06 ${sys:es.logs.cluster\_name}-2018-09-23-1.log.gz > -rw-r--r-- 1 elasticsearch elasticsearch 11K Nov 8 13:31 ${sys:es.logs.cluster\_name}-2018-10-20-1.log.gz > -rw-r--r-- 1 elasticsearch elasticsearch 804 Nov 8 13:31 ${sys:es.logs.cluster\_name}\_deprecation.log > -rw-r--r-- 1 elasticsearch elasticsearch 0 Nov 22 2017 ${sys:es.logs.cluster\_name}\_index\_indexing\_slowlog.log > -rw-r--r-- 1 elasticsearch elasticsearch 0 Nov 22 2017 ${sys:es.logs.cluster\_name}\_index\_search\_slowlog.log > -rw-r--r-- 1 elasticsearch elasticsearch 6.2K Nov 8 13:33 ${sys:es.logs.cluster\_name}.log Directories for log files have been created in a location other than specified in elasticsearch.yml, and the directory names created there treat those values in log4j2.properties as string literals and creating directories with those variables as the names! If not from elasticsearch.yml, where does log4j2 get its values for the log directory and cluster name? I'm ending up with what's essentially nonsense, and what's been put into place isn't working. I have looked for days for documentation or forums that might explain how log4j2 gets data for its logging specs from Elasticsearch, and I've found nothing. ---
**Author:** ![kwstx14](https://avatars.discourse-cdn.com/v4/letter/k/9e8a1a/32.png) [@kwstx14](https://discuss.elastic.co/u/kwstx14)\ **Post date:** [December 19, 2018, 9:43pm UTC](https://discuss.elastic.co/t/es-5-2-log-files-not-being-written/161585/2 "2018-12-19T21:43:59Z")
An update: I decided to try using the log4j2.properties from an earlier version of Elasticsearch (1.7.3). That file uses {sys:es.logs} instead of {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}. I restarted the Elasticsearch service, and it worked! I got log files in the intended location. ---
**Author:** ![kwstx14](https://avatars.discourse-cdn.com/v4/letter/k/9e8a1a/32.png) [@kwstx14](https://discuss.elastic.co/u/kwstx14)\ **Post date:** [December 20, 2018, 3:40pm UTC](https://discuss.elastic.co/t/es-5-2-log-files-not-being-written/161585/3 "2018-12-20T15:40:45Z")
One more update: I used the log4j2.properties file from Elastiscsearch 1.7.3 on version 5.2.0, and logging ran. This turns out to be about the version of the elastic/elasticsearch Puppet module used. We're using release 6.0.0, which is the first version of the module that changed the variables used in log4j2.properties. It seems that I might want to consider backing off to release 5.5.0, which has the right variables in use in that erb file. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2019, 3:40pm UTC](https://discuss.elastic.co/t/es-5-2-log-files-not-being-written/161585/4 "2019-01-17T15:40:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.