I am getting an error when I tried to restart elasticsearch service

Elastic Stack Elasticsearch
1

I removed elasticsearch and reinstalled it. When I tried to restart the service I get this error:

elasticsearch.service - Starts and stops a single elasticsearch instance on this system
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled)
Active: failed (Result: exit-code) since Thu 2016-03-17 11:07:41 EDT; 18s ago
Docs: http://www.elasticsearch.org
Process: 3455 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -d -p /var/run/elasticsearch/elasticsearch.pid -Des.default.config=$CONF_FILE -Des.default.path.home=$ES_HOME -Des.default.path.logs=$LOG_DIR -Des.default.path.data=$DATA_DIR -Des.default.path.work=$WORK_DIR -Des.default.path.conf=$CONF_DIR (code=exited, status=1/FAILURE)
Main PID: 16725 (code=exited, status=143)
CGroup: /system.slice/elasticsearch.service

Mar 17 11:07:36 cba-vml-ops-elk01 elasticsearch[3455]: at java.nio.file.FileTreeWalker.walk(FileTreeWalker.java:322)
Mar 17 11:07:36 cba-vml-ops-elk01 elasticsearch[3455]: at java.nio.file.Files.walkFileTree(Files.java:2662)
Mar 17 11:07:36 cba-vml-ops-elk01 elasticsearch[3455]: at org.elasticsearch.common.logging.log4j.LogConfigurator.resolveConfig(LogConfigurator.java:142)
Mar 17 11:07:36 cba-vml-ops-elk01 elasticsearch[3455]: ... 4 more
Mar 17 11:07:36 cba-vml-ops-elk01 elasticsearch[3455]: log4j:WARN No appenders could be found for logger (bootstrap).
Mar 17 11:07:36 cba-vml-ops-elk01 elasticsearch[3455]: log4j:WARN Please initialize the log4j system properly.
Mar 17 11:07:36 cba-vml-ops-elk01 elasticsearch[3455]: log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
Mar 17 11:07:41 cba-vml-ops-elk01 systemd[1]: elasticsearch.service: control process exited, code=exited status=1
Mar 17 11:07:41 cba-vml-ops-elk01 systemd[1]: Failed to start Starts and stops a single elasticsearch instance on this system.
Mar 17 11:07:41 cba-vml-ops-elk01 systemd[1]: Unit elasticsearch.service entered failed state.

Warning: Unit file changed on disk, 'systemctl daemon-reload' recommended.

2

Did you change any of the path variables in settings.

3

no. I just removed the package elasticsearch and then reinstalled it.
Does the log indicate something wrong with the path?

4

I updated the permissions on the elasticsearch directory and that fixed the issue.
It seems like there wasn't permission to access the nodes.

5

A couple things to try.

Run this command as root
systemctl daemon-reload so it reloads you systemctl configs. If systemctl is using old configs in memory it can mess things up. This command wil lreload the systemd process so that it no longer attempts to reference the old files and reverts back to using the new system copies.

Now try to start elasticsearch.
If it still will not start I have had (for some reason i never figured out) the elasticsearch username UID and Group GID change. I did an upgrade and when elasticsearch would not start I found a folder with old UID and GID numbers that were associated with the old Elasticsearch user. I guess the user was removed and re-added except with different UID and GID's . Check that the name is associated with the files that ES uses.
chown recursively the folders to fix if you find files with UID/GID numbers instead of elasitcsearch:elasticsearch user group

Also I have had trouble with the /etc/systemd/system/elasticsearch.service file. There were some differences that my new install didn' t like. You can try to run elasticsearch from the /usr/share/elasticsearch/bin folder and see if it will run as a standalone w/o calling it with systemctl as this will tell you it may or may not be problems with /etc/systemd/system/elasticsearch.service file.

Last inspect the elasticsearch.yml file. It is probably ok but I would look closely at it just to be sure.

I hope this helps some. I had several things that stopped my es.service from starting and it was somewhat time consuming to find.
Good luck and let us know how it turns out.

6

I just saw your latest post. I had the reply to your post above typed out but had to go to a meeting and when I came back I proof read and sent, then I saw your new post. Like I thought it was associated with permissions.

Sorry I didn't hit the reply button this AM, it may have saved some time.

Maybe it will help someone else.

Have a good weekend!

Mark

7

You are absolutely right. The permissions on elasticsearch UID and GID were set as 755 and they couldn't write to the nodes directory. I changed permissions to 777 and that fixed it.