# Fail start Elastic

**URL:** <https://discuss.elastic.co/t/fail-start-elastic/598>\
**Category:** Elasticsearch\
**Created:** [May 13, 2015, 7:25am UTC](https://discuss.elastic.co/t/fail-start-elastic/598 "2015-05-13T07:25:16Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 13, 2015, 7:25am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/1 "2015-05-13T07:25:16Z")

</div>

Hello experts,

I have plan forward rsyslog to elasticsearch.  
I also installation Rsyslog v8 and Elastic v1.5.2 both on same server.  
But when start Elastic with error message:  
_bin/elasticsearch start_  
_Failed to configure logging..._  
_org.elasticsearch.ElasticsearchException: Failed to load logging configuration_  
_at org.elasticsearch.common.logging.log4j.LogConfigurator.resolveConfig(LogConfigurator.java:139)_  
_at org.elasticsearch.common.logging.log4j.LogConfigurator.configure(LogConfigurator.java:89)_  
_at org.elasticsearch.bootstrap.Bootstrap.setupLogging(Bootstrap.java:100)_  
_at org.elasticsearch.bootstrap.Bootstrap.main(Bootstrap.java:184)_  
_at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:32)_  
_Caused by: java.nio.file.NoSuchFileException: /usr/share/elasticsearch/config_  
_at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)_  
_at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)_  
_at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)_  
_at sun.nio.fs.UnixFileAttributeViews$Basic.readAttributes(UnixFileAttributeViews.java:55)_  
_at sun.nio.fs.UnixFileSystemProvider.readAttributes(UnixFileSystemProvider.java:144)_  
_at sun.nio.fs.LinuxFileSystemProvider.readAttributes(LinuxFileSystemProvider.java:97)_  
_at java.nio.file.Files.readAttributes(Files.java:1686)_  
_at java.nio.file.FileTreeWalker.walk(FileTreeWalker.java:109)_  
_at java.nio.file.FileTreeWalker.walk(FileTreeWalker.java:69)_  
_at java.nio.file.Files.walkFileTree(Files.java:2602)_  
_at org.elasticsearch.common.logging.log4j.LogConfigurator.resolveConfig(LogConfigurator.java:123)_  
_... 4 more_  
_log4j:WARN No appenders could be found for logger (node)._  
_log4j:WARN Please initialize the log4j system properly._  
_log4j:WARN See [http://logging.apache.org/log4j/1.2/faq.html#noconfig](http://logging.apache.org/log4j/1.2/faq.html#noconfig) for more info._

Here is some info our system may useful:  
**curl localhost:9200/\_nodes/process?pretty**  
_{_  
_"cluster\_name" : "elasticsearch",_  
_"nodes" : {_  
_"qzzvM8CTQdC1TvyqYkqxQg" : {_  
_"name" : "Lin Sun",_  
_"transport\_address" : "inet[/10.126.122.28:9301]",_  
_"host" : "server01.global",_  
_"ip" : "10.126.122.28",_  
_"version" : "1.5.2",_  
_"build" : "62ff986",_  
_"http\_address" : "inet[/10.126.122.28:9200]",_  
_"process" : {_  
_"refresh\_interval\_in\_millis" : 1000,_  
_"id" : 9432,_  
_"max\_file\_descriptors" : 4096,_  
_"mlockall" : false_  
_}_  
_},_  
_"yU\_EVRjCQHGatyrOUUQLmw" : {_  
_"name" : "logstash-server01.global-5661-2016",_  
_"transport\_address" : "inet[/10.126.122.28:9300]",_  
_"host" : "server01.global",_  
_"ip" : "10.126.122.28",_  
_"version" : "1.1.1",_  
_"build" : "f1585f0",_  
_"attributes" : {_  
_"client" : "true",_  
_"data" : "false"_  
_},_  
_"process" : {_  
_"refresh\_interval\_in\_millis" : 1000,_  
_"id" : 5661,_  
_"max\_file\_descriptors" : 16384,_  
_"mlockall" : false_  
_}_  
_}_  
_}_  
_}_

**curl [http://localhost:9200](http://localhost:9200)**  
_{_  
_"status" : 200,_  
_"name" : "Lin Sun",_  
_"cluster\_name" : "elasticsearch",_  
_"version" : {_  
_"number" : "1.5.2",_  
_"build\_hash" : "62ff9868b4c8a0c45860bebb259e21980778ab1c",_  
_"build\_timestamp" : "2015-04-27T09:21:06Z",_  
_"build\_snapshot" : false,_  
_"lucene\_version" : "4.10.4"_  
_},_  
_"tagline" : "You Know, for Search"_  
_}_

My elasticsearch.yml file is located in /etc/elasticsearch

Any help is very very appreciated,

Regards,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 13, 2015, 7:40am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/2 "2015-05-13T07:40:40Z")

</div>

What about /etc/elasticsearch/logging.yml?

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 13, 2015, 8:41am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/3 "2015-05-13T08:41:02Z")

</div>

Hello,

It seems is default.  
_##################### Elasticsearch Configuration Example #####################_

_# This file contains an overview of various configuration settings,_  
_# targeted at operations staff. Application developers should_  
_# consult the guide at [http://elasticsearch.org/guide](http://elasticsearch.org/guide)._  
_#_  
_# The installation procedure is covered at_  
_# [http://elasticsearch.org/guide/en/elasticsearch/reference/current/setup.html](http://elasticsearch.org/guide/en/elasticsearch/reference/current/setup.html)._  
_#_  
_# Elasticsearch comes with reasonable defaults for most settings,_  
_# so you can try it out without bothering with configuration._  
_#_  
_# Most of the time, these defaults are just fine for running a production_  
_# cluster. If you're fine-tuning your cluster, or wondering about the_  
_# effect of certain configuration option, please do ask on the_  
_# mailing list or IRC channel [[http://elasticsearch.org/community](http://elasticsearch.org/community)]._

_# Any element in the configuration can be replaced with environment variables_  
_# by placing them in ${...} notation. For example:_  
_#_  
_#node.rack: ${RACK\_ENV\_VAR}_

_# For information on supported formats and syntax for the config file, see_  
_# [http://elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html](http://elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html)_

_################################### Cluster ###################################_

_# Cluster name identifies your cluster for auto-discovery. If you're running_  
_# multiple clusters on the same network, make sure you're using unique names._  
_#_  
_#cluster.name: elasticsearch_

_#################################### Node #####################################_

_# Node names are generated dynamically on startup, so you're relieved_  
_# from configuring them manually. You can tie this node to a specific name:_  
_#_  
_#node.name: "Franz Kafka"_

_# Every node can be configured to allow or deny being eligible as the master,_  
_# and to allow or deny to store the data._  
_#_  
_# Allow this node to be eligible as a master node (enabled by default):_  
_#_  
_#node.master: true_  
_#_  
_# Allow this node to store data (enabled by default):_  
_#_  
_#node.data: true_

_# You can exploit these settings to design advanced cluster topologies._  
_#_  
_# 1. You want this node to never become a master node, only to hold data._  
_# This will be the "workhorse" of your cluster._  
_#_  
_#node.master: false_  
_#node.data: true_  
_#_  
_# 2. You want this node to only serve as a master: to not store any data and_  
_# to have free resources. This will be the "coordinator" of your cluster._  
_#_  
_#node.master: true_  
_#node.data: false_  
_#_  
_# 3. You want this node to be neither master nor data node, but_  
_# to act as a "search load balancer" (fetching data from nodes,_  
_# aggregating results, etc.)_  
_#_  
_#node.master: false_  
_#node.data: false_

_# Use the Cluster Health API [[http://localhost:9200/\_cluster/health](http://localhost:9200/_cluster/health)], the_  
_# Node Info API [[http://localhost:9200/\_nodes](http://localhost:9200/_nodes)] or GUI tools_  
_# such as [http://www.elasticsearch.org/overview/marvel/](http://www.elasticsearch.org/overview/marvel/),_  
_# [http://github.com/karmi/elasticsearch-paramedic](http://github.com/karmi/elasticsearch-paramedic),_  
_# [http://github.com/lukas-vlcek/bigdesk](http://github.com/lukas-vlcek/bigdesk) and_  
_# [http://mobz.github.com/elasticsearch-head](http://mobz.github.com/elasticsearch-head) to inspect the cluster state._

_# A node can have generic attributes associated with it, which can later be used_  
_# for customized shard allocation filtering, or allocation awareness. An attribute_  
_# is a simple key value pair, similar to node.key: value, here is an example:_  
_#_  
_#node.rack: rack314_

_# By default, multiple nodes are allowed to start from the same installation location_  
_# to disable it, set the following:_  
_#node.max\_local\_storage\_nodes: 1_

_#################################### Index ####################################_

_# You can set a number of options (such as shard/replica options, mapping_  
_# or analyzer definitions, translog settings, ...) for indices globally,_  
_# in this file._  
_#_  
_# Note, that it makes more sense to configure index settings specifically for_  
_# a certain index, either when creating it or by using the index templates API._  
_#_  
_# See [http://elasticsearch.org/guide/en/elasticsearch/reference/current/index-modules.html](http://elasticsearch.org/guide/en/elasticsearch/reference/current/index-modules.html) and_  
_# [http://elasticsearch.org/guide/en/elasticsearch/reference/current/indices-create-index.html](http://elasticsearch.org/guide/en/elasticsearch/reference/current/indices-create-index.html)_  
_# for more information._

_# Set the number of shards (splits) of an index (5 by default):_  
_#_  
_#index.number\_of\_shards: 5_

_# Set the number of replicas (additional copies) of an index (1 by default):_  
_#_  
_#index.number\_of\_replicas: 1_

_# Note, that for development on a local machine, with small indices, it usually_  
_# makes sense to "disable" the distributed features:_  
_#_  
_#index.number\_of\_shards: 1_  
_#index.number\_of\_replicas: 0_

_# These settings directly affect the performance of index and search operations_  
_# in your cluster. Assuming you have enough machines to hold shards and_  
_# replicas, the rule of thumb is:_  
_#_  
_# 1. Having more shards enhances the indexing performance and allows to_  
_# distribute a big index across machines._  
_# 2. Having more replicas enhances the search performance and improves the_  
_# cluster availability._  
_#_  
_# The "number\_of\_shards" is a one-time setting for an index._  
_#_  
_# The "number\_of\_replicas" can be increased or decreased anytime,_  
_# by using the Index Update Settings API._  
_#_  
_# Elasticsearch takes care about load balancing, relocating, gathering the_  
_# results from nodes, etc. Experiment with different settings to fine-tune_  
_# your setup._

_# Use the Index Status API ([http://localhost:9200/A/\_status](http://localhost:9200/A/_status)) to inspect_  
_# the index status._

_#################################### Paths ####################################_

_# Path to directory containing configuration (this file and logging.yml):_  
_#_  
_#path.conf: /path/to/conf_

_# Path to directory where to store index data allocated for this node._  
_#_  
_#path.data: /path/to/data_  
_#_  
_# Can optionally include more than one location, causing data to be striped across_  
_# the locations (a la RAID 0) on a file level, favouring locations with most free_  
_# space on creation. For example:_  
_#_  
_#path.data: /path/to/data1,/path/to/data2_

_# Path to temporary files:_  
_#_  
_#path.work: /path/to/work_

_# Path to log files:_  
_#_  
_#path.logs: /path/to/logs_

_# Path to where plugins are installed:_  
_#_  
_#path.plugins: /path/to/plugins_

_#################################### Plugin ###################################_

_# If a plugin listed here is not installed for current node, the node will not start._  
_#_  
_#plugin.mandatory: mapper-attachments,lang-groovy_

_################################### Memory ####################################_

_# Elasticsearch performs poorly when JVM starts swapping: you should ensure that_  
_# it never swaps._  
_#_  
_# Set this property to true to lock the memory:_  
_#_  
_#bootstrap.mlockall: true_

_# Make sure that the ES\_MIN\_MEM and ES\_MAX\_MEM environment variables are set_  
_# to the same value, and that the machine has enough memory to allocate_  
_# for Elasticsearch, leaving enough memory for the operating system itself._  
_#_  
_# You should also make sure that the Elasticsearch process is allowed to lock_  
_# the memory, eg. by using `ulimit -l unlimited`._

_############################## Network And HTTP ###############################_

_# Elasticsearch, by default, binds itself to the 0.0.0.0 address, and listens_  
_# on port [9200-9300] for HTTP traffic and on port [9300-9400] for node-to-node_  
_# communication. (the range means that if the port is busy, it will automatically_  
_# try the next port)._

_# Set the bind address specifically (IPv4 or IPv6):_  
_#_  
_#network.bind\_host: 192.168.0.1_

_# Set the address other nodes will use to communicate with this node. If not_  
_# set, it is automatically derived. It must point to an actual IP address._  
_#_  
_#network.publish\_host: 192.168.0.1_

_# Set both 'bind\_host' and 'publish\_host':_  
_#_  
_#network.host: 192.168.0.1_

_# Set a custom port for the node to node communication (9300 by default):_  
_#_  
_#transport.tcp.port: 9300_

_# Enable compression for all communication between nodes (disabled by default):_  
_#_  
_#transport.tcp.compress: true_

_# Set a custom port to listen for HTTP traffic:_  
_#_  
_#http.port: 9200_

_# Set a custom allowed content length:_  
_#_  
_#http.max\_content\_length: 100mb_

_# Disable HTTP completely:_  
_#_  
_#http.enabled: false_

_################################### Gateway ###################################_

_# The gateway allows for persisting the cluster state between full cluster_  
_# restarts. Every change to the state (such as adding an index) will be stored_  
_# in the gateway, and when the cluster starts up for the first time,_  
_# it will read its state from the gateway._

_# There are several types of gateway implementations. For more information, see_  
_# [http://elasticsearch.org/guide/en/elasticsearch/reference/current/modules-gateway.html](http://elasticsearch.org/guide/en/elasticsearch/reference/current/modules-gateway.html)._

_# The default gateway type is the "local" gateway (recommended):_  
_#_  
_#gateway.type: local_

_# Settings below control how and when to start the initial recovery process on_  
_# a full cluster restart (to reuse as much local data as possible when using shared_  
_# gateway)._

_# Allow recovery process after N nodes in a cluster are up:_  
_#_  
_#gateway.recover\_after\_nodes: 1_

_# Set the timeout to initiate the recovery process, once the N nodes_  
_# from previous setting are up (accepts time value):_  
_#_  
_#gateway.recover\_after\_time: 5m_

_# Set how many nodes are expected in this cluster. Once these N nodes_  
_# are up (and recover\_after\_nodes is met), begin recovery process immediately_  
_# (without waiting for recover\_after\_time to expire):_  
_#_  
_#gateway.expected\_nodes: 2_

_############################# Recovery Throttling #############################_

_# These settings allow to control the process of shards allocation between_  
_# nodes during initial recovery, replica allocation, rebalancing,_  
_# or when adding and removing nodes._

_# Set the number of concurrent recoveries happening on a node:_  
_#_  
_# 1. During the initial recovery_  
_#_  
_#cluster.routing.allocation.node\_initial\_primaries\_recoveries: 4_  
_#_  
_# 2. During adding/removing nodes, rebalancing, etc_  
_#_  
_#cluster.routing.allocation.node\_concurrent\_recoveries: 2_

_# Set to throttle throughput when recovering (eg. 100mb, by default 20mb):_  
_#_  
_#indices.recovery.max\_bytes\_per\_sec: 20mb_

_# Set to limit the number of open concurrent streams when_  
_# recovering a shard from a peer:_  
_#_  
_#indices.recovery.concurrent\_streams: 5_

_################################## Discovery ##################################_

_# Discovery infrastructure ensures nodes can be found within a cluster_  
_# and master node is elected. Multicast discovery is the default._

_# Set to ensure a node sees N other master eligible nodes to be considered_  
_# operational within the cluster. This should be set to a quorum/majority of_  
_# the master-eligible nodes in the cluster._  
_#_  
_#discovery.zen.minimum\_master\_nodes: 1_

_# Set the time to wait for ping responses from other nodes when discovering._  
_# Set this option to a higher value on a slow or congested network_  
_# to minimize discovery failures:_  
_#_  
_#discovery.zen.ping.timeout: 3s_

_# For more information, see_  
_# [http://elasticsearch.org/guide/en/elasticsearch/reference/current/modules-discovery-zen.html](http://elasticsearch.org/guide/en/elasticsearch/reference/current/modules-discovery-zen.html)_

_# Unicast discovery allows to explicitly control which nodes will be used_  
_# to discover the cluster. It can be used when multicast is not present,_  
_# or to restrict the cluster communication-wise._  
_#_  
_# 1. Disable multicast discovery (enabled by default):_  
_#_  
_#discovery.zen.ping.multicast.enabled: false_  
_#_  
_# 2. Configure an initial list of master nodes in the cluster_  
_# to perform discovery when new nodes (master or data) are started:_  
_#_  
_#discovery.zen.ping.unicast.hosts: ["host1", "host2:port"]_

_# EC2 discovery allows to use AWS EC2 API in order to perform discovery._  
_#_  
_# You have to install the cloud-aws plugin for enabling the EC2 discovery._  
_#_  
_# For more information, see_  
_# [http://elasticsearch.org/guide/en/elasticsearch/reference/current/modules-discovery-ec2.html](http://elasticsearch.org/guide/en/elasticsearch/reference/current/modules-discovery-ec2.html)_  
_#_  
_# See [http://elasticsearch.org/tutorials/elasticsearch-on-ec2/](http://elasticsearch.org/tutorials/elasticsearch-on-ec2/)_  
_# for a step-by-step tutorial._

_# GCE discovery allows to use Google Compute Engine API in order to perform discovery._  
_#_  
_# You have to install the cloud-gce plugin for enabling the GCE discovery._  
_#_  
_# For more information, see [https://github.com/elasticsearch/elasticsearch-cloud-gce](https://github.com/elasticsearch/elasticsearch-cloud-gce)._

_# Azure discovery allows to use Azure API in order to perform discovery._  
_#_  
_# You have to install the cloud-azure plugin for enabling the Azure discovery._  
_#_  
_# For more information, see [https://github.com/elasticsearch/elasticsearch-cloud-azure](https://github.com/elasticsearch/elasticsearch-cloud-azure)._

_################################## Slow Log ##################################_

_# Shard level query and fetch threshold logging._

_#index.search.slowlog.threshold.query.warn: 10s_  
_#index.search.slowlog.threshold.query.info: 5s_  
_#index.search.slowlog.threshold.query.debug: 2s_  
_#index.search.slowlog.threshold.query.trace: 500ms_

_#index.search.slowlog.threshold.fetch.warn: 1s_  
_#index.search.slowlog.threshold.fetch.info: 800ms_  
_#index.search.slowlog.threshold.fetch.debug: 500ms_  
_#index.search.slowlog.threshold.fetch.trace: 200ms_

_#index.indexing.slowlog.threshold.index.warn: 10s_  
_#index.indexing.slowlog.threshold.index.info: 5s_  
_#index.indexing.slowlog.threshold.index.debug: 2s_  
_#index.indexing.slowlog.threshold.index.trace: 500ms_

_################################## GC Logging ################################_

_#monitor.jvm.gc.young.warn: 1000ms_  
_#monitor.jvm.gc.young.info: 700ms_  
_#monitor.jvm.gc.young.debug: 400ms_

_#monitor.jvm.gc.old.warn: 10s_  
_#monitor.jvm.gc.old.info: 5s_  
_#monitor.jvm.gc.old.debug: 2s_

_################################## Security ################################_

_# Uncomment if you want to enable JSONP as a valid return transport on the_  
_# http server. With this enabled, it may pose a security risk, so disabling_  
_# it unless you need it is recommended (it is disabled by default)._  
_#_  
_#http.jsonp.enable: true_

I am newbie, please point me the right direction.

Thanks a lot

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 13, 2015, 9:54am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/4 "2015-05-13T09:54:15Z")

</div>

Never mind elasticsearch.yml. It's logging.yml I'm asking about. Do you have such a file in /etc/elasticsearch?

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 13, 2015, 2:22pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/5 "2015-05-13T14:22:52Z")

</div>

Hi,  
I had a file:  
**cat logging.yml**  
_# you can override this using by setting a system property, for example -Des.logger.level=DEBUG_  
_es.logger.level: INFO_  
_rootLogger: ${es.logger.level}, console, file_  
_logger:_  
_# log action execution errors for easier debugging_  
_action: DEBUG_  
_# reduce the logging for aws, too much is logged under the default INFO_  
_com.amazonaws: WARN_

_# gateway_  
_#gateway: DEBUG_  
_#index.gateway: DEBUG_

_# peer shard recovery_  
_#indices.recovery: DEBUG_

_# discovery_  
_#discovery: TRACE_

_index.search.slowlog: TRACE, index\_search\_slow\_log\_file_  
_index.indexing.slowlog: TRACE, index\_indexing\_slow\_log\_file_

_additivity:_  
_index.search.slowlog: false_  
_index.indexing.slowlog: false_

_appender:_  
_console:_  
_type: console_  
_layout:_  
_type: consolePattern_  
_conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"_

_file:_  
_type: dailyRollingFile_  
_file: ${path.logs}/${cluster.name}.log_  
_datePattern: "'.'yyyy-MM-dd"_  
_layout:_  
_type: pattern_  
_conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"_

_# Use the following log4j-extras RollingFileAppender to enable gzip compression of log files._  
_# For more information see [https://logging.apache.org/log4j/extras/apidocs/org/apache/log4j/rolling/RollingFileAppender.html](https://logging.apache.org/log4j/extras/apidocs/org/apache/log4j/rolling/RollingFileAppender.html)_  
_#file:_  
_#type: extrasRollingFile_  
_#file: ${path.logs}/${cluster.name}.log_  
_#rollingPolicy: timeBased_  
_#rollingPolicy.FileNamePattern: ${path.logs}/${cluster.name}.log.%d{yyyy-MM-dd}.gz_  
_#layout:_  
_#type: pattern_  
_#conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"_

_index\_search\_slow\_log\_file:_  
_type: dailyRollingFile_  
_file: ${path.logs}/${cluster.name}\_index\_search\_slowlog.log_  
_datePattern: "'.'yyyy-MM-dd"_  
_layout:_  
_type: pattern_  
_conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"_

_index\_indexing\_slow\_log\_file:_  
_type: dailyRollingFile_  
_file: ${path.logs}/${cluster.name}\_index\_indexing\_slowlog.log_  
_datePattern: "'.'yyyy-MM-dd"_  
_layout:_  
_type: pattern_  
_conversionPattern: "[%d{ISO8601}][%-5p][%-25c] %m%n"_

Any help is appreciated,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 13, 2015, 5:42pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/6 "2015-05-13T17:42:37Z")

</div>

Is there really no indentation in the file? If not the file isn't valid YAML which would explain why Elasticsearch isn't able to load it. Where did you get the file from? It's not the stock one from the Elasticsearch distribution.

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 14, 2015, 1:37am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/7 "2015-05-14T01:37:21Z")

</div>

Hello,

I had v1.5.2 from repo as guide on community. But before that i installed elasticsearch v1.1.  
How can i do now?

Regards,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 14, 2015, 10:16am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/8 "2015-05-14T10:16:10Z")

</div>

> I had v1.5.2 from repo as guide on community. But before that i installed elasticsearch v1.1.  
> How can i do now?

Sorry, I have no idea what you're asking. Please answer my previous questions about your logging.yml.

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 14, 2015, 12:54pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/9 "2015-05-14T12:54:45Z")

</div>

Hello,  
I think i had logging.yml from v1.1 before. But after i installed v1.5 ít ia fail.  
How i can do now?  
Regards,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 14, 2015, 2:50pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/10 "2015-05-14T14:50:03Z")

</div>

Using the logging.yml that ships with the ES version you're using would be a good way of getting back to a sane state. Once that's done you can start adding your customizations.

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 15, 2015, 1:46am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/11 "2015-05-15T01:46:36Z")

</div>

Hello,

Which you mean? Could you please show me clearly. I am newbie in ES.

Any suggestion is very appreciated,

Regards,

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 15, 2015, 3:16am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/12 "2015-05-15T03:16:44Z")

</div>

How did you install Elasticsearch?

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 15, 2015, 4:19am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/13 "2015-05-15T04:19:53Z")

</div>

Hello,

I installed from repo

Here is the list file that i had:  
**ls -l /etc/elasticsearch/**  
total 52  
-rw-r--r-- 1 root root 13500 May 14 15:27 elasticsearch.yml  
-rw-r--r-- 1 root root 13208 Nov 8 2014 [elasticsearch.yml.org](http://elasticsearch.yml.org)  
-rw-r--r-- 1 root root 13260 Nov 8 2014 elasticsearch.yml.rpmsave  
-rw-r--r-- 1 root root 2030 Apr 27 16:34 logging.yml

**ls -l /usr/share/elasticsearch/**  
total 44  
drwxr-xr-x 2 root root 4096 May 13 13:26 bin  
drwxr-xr-x 3 root root 4096 May 13 13:50 data  
drwxr-xr-x 3 root root 4096 May 13 13:26 lib  
-rw-r--r-- 1 root root 11358 Apr 27 16:34 LICENSE.txt  
-rw-r--r-- 1 root root 150 Apr 27 16:34 NOTICE.txt  
drwxr-xr-x 3 elasticsearch elasticsearch 4096 May 13 13:49 plugins  
-rw-r--r-- 1 root root 8499 Apr 27 16:34 README.textile

Any suggestion is very very appreciated,

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 15, 2015, 4:57am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/14 "2015-05-15T04:57:26Z")

</div>

Then you should be using `service elasticsearch start` instead of calling `bin\elasticsearch`.

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 15, 2015, 6:13am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/15 "2015-05-15T06:13:04Z")

</div>

Hello,

I just using `service elasticsearch start` instead of calling `bin\elasticsearc`h and changed permission to 777 on `/var/log/elasticsearch`.  
But still error when checking the status:

```
[root@subsys]# service elasticsearch start
Starting elasticsearch: [OK]
[root@subsys]# service elasticsearch status
elasticsearch dead but subsys locked

```

Although,GO to :  
cd /var/lock/subsys  
delete elasticsearch file  
rm elasticsearch  
stop the elasticsearch  
and start the elasticsearch  
But elasticsearch still dead

I also checked `elasticsearch.log` file on `/var/log/elasticsearch`:

```
[root@elasticsearch]# cat elasticsearch.log

    [2015-05-15 13:08:46,170][INFO][node] [Aldebron] version[1.5.2], pid[32730], build[62ff986/2015-04-27T09:21:06Z]
    [2015-05-15 13:08:46,171][INFO][node] [Aldebron] initializing ...
    [2015-05-15 13:08:46,175][INFO][plugins] [Aldebron] loaded [], sites [head]
    [2015-05-15 13:08:46,210][ERROR][bootstrap] Exception
    org.elasticsearch.ElasticsearchIllegalStateException: Failed to created node environment
            at org.elasticsearch.node.internal.InternalNode.<init>(InternalNode.java:162)
            at org.elasticsearch.node.NodeBuilder.build(NodeBuilder.java:159)
            at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:70)
            at org.elasticsearch.bootstrap.Bootstrap.main(Bootstrap.java:213)
            at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:32)
    Caused by: java.nio.file.AccessDeniedException: /var/lib/elasticsearch/elasticsearch/nodes/1
            at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84)
            at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
            at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
            at sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:383)
            at java.nio.file.Files.createDirectory(Files.java:630)
            at java.nio.file.Files.createAndCheckIsDirectory(Files.java:734)
            at java.nio.file.Files.createDirectories(Files.java:720)
            at org.elasticsearch.env.NodeEnvironment.<init>(NodeEnvironment.java:105)
            at org.elasticsearch.node.internal.InternalNode.<init>(InternalNode.java:160)
            ... 4 more
    [root@elasticsearch]# java -version
    java version "1.7.0_79"
    OpenJDK Runtime Environment (rhel-2.5.5.1.el6_6-x86_64 u79-b14)
    OpenJDK 64-Bit Server VM (build 24.79-b02, mixed mode)
    You have mail in /var/spool/mail/root

```

Where configuration i am wrong?

Regards,

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 15, 2015, 10:07pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/16 "2015-05-15T22:07:41Z")

</div>

> [@trungmv](#):
>
> Caused by: java.nio.file.AccessDeniedException: /var/lib/elasticsearch/elasticsearch/nodes/1

That is the problem.  
Did you do any manual permissions changes after the install process?

---

<div class="post-metadata">

**Author:** ![Thomas\_Muhlfriedel](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@Thomas\_Muhlfriedel](https://discuss.elastic.co/u/Thomas_Muhlfriedel)\
**Post date:** [May 20, 2015, 7:26pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/17 "2015-05-20T19:26:40Z")

</div>

Hello there. I also installed from the PPA on kubuntu and ran into the same problem, elastic wouldn't start with the above error of access denied when run as a service with systemctl.  
The problem I think is that user **elasticsearch** does not have permission to write in _/usr/share/elasticsearch_ which belongs to **root** where it tries to create a data folder to set up the nodes. I got around the problem by creating a folder _/usr/share/elasticsearch/data_ myself and chown it to _elasticsearch:elasticsearch_ and I could start the service! The log4j problem probably belongs to the same category.

regards, Thomas

---

<div class="post-metadata">

**Author:** ![trungmv](https://avatars.discourse-cdn.com/v4/letter/t/da6949/32.png) [@trungmv](https://discuss.elastic.co/u/trungmv)\
**Post date:** [May 21, 2015, 1:32am UTC](https://discuss.elastic.co/t/fail-start-elastic/598/18 "2015-05-21T01:32:29Z")

</div>

Hello,

Now, I can start elasticsearch with change permission for elasticsearch

Thanks for all support.

---

<div class="post-metadata">

**Author:** ![deepakthota](https://avatars.discourse-cdn.com/v4/letter/d/5f8ce5/32.png) [@deepakthota](https://discuss.elastic.co/u/deepakthota)\
**Post date:** [September 21, 2016, 9:33pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/19 "2016-09-21T21:33:48Z")

</div>

I know this is a old post but I am facing the same error in CentOS and I just can't figure how to use the new data folder created

---

<div class="post-metadata">

**Author:** ![MarkOStewart](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@MarkOStewart](https://discuss.elastic.co/u/MarkOStewart)\
**Post date:** [September 23, 2016, 1:45pm UTC](https://discuss.elastic.co/t/fail-start-elastic/598/20 "2016-09-23T13:45:19Z")

</div>

try  
chown elasticsearch:elasticsearch /path/to/newdatafolder

All folders and files and logs etc need to be owned by elasticsearch:elasticsearch (owner:group)

[Next page](https://discuss.elastic.co/t/fail-start-elastic/598.md?page=2)