Unable to start elastic search

Hi, I install elastic search using sudo dpkg -i /path-to-file/installer.deb on ubuntu. Recently I tried to enable the security feature but after i add lines in elasticsearch.yml, service refuse to start it. I tried to read log, documentation but got nothing.

Configuration
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: oneload_elasticsearch
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["127.0.0.1", "[::1]", "localhost","10.***.***.**"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
# ---------------------------------- Security ----------------------------------
#xpack.security.enabled: true
#xpack.security.http.ssl.enabled: true
#xpack.security.http.ssl.keystore.path: /home/oneload/certs/elastic-certificates.p12
#xpack.security.http.ssl.truststore.path: /home/oneload/certs/elastic-certificates.p12
#xpack.security.transport.ssl.enabled: true
#xpack.security.transport.ssl.verification_mode: certificate
#xpack.security.transport.ssl.keystore.path: /home/oneload/certs/elastic-certificates.p12
#xpack.security.transport.ssl.truststore.path: /home/oneload/certs/elastic-certificates.p12

If I comment xpack lines, service works fine without any issues.

Log output

log output by using journalctl -xe

Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.initialize(AbstractConfiguration.java:238)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.start(AbstractConfiguration.java:250)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.LoggerContext.setConfiguration(LoggerContext.java:547)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:263)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.common.logging.LogConfigurator.configure(LogConfigurator.java:234)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.common.logging.LogConfigurator.configure(LogConfigurator.java:127)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:310)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.cli.Command.main(Command.java:90)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]: 2019-11-15 08:55:07,314 main ERROR Unable to invoke factory method in class org.apache.logging.log4j.core.appender.Roll
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.plugins.util.PluginBuilder.findFactoryMethod(PluginBuilder.java:235)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.plugins.util.PluginBuilder.build(PluginBuilder.java:135)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.createPluginObject(AbstractConfiguration.java:959
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:89
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:89
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.doConfigure(AbstractConfiguration.java:514)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.initialize(AbstractConfiguration.java:238)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.config.AbstractConfiguration.start(AbstractConfiguration.java:250)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.LoggerContext.setConfiguration(LoggerContext.java:547)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:263)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.common.logging.LogConfigurator.configure(LogConfigurator.java:234)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.common.logging.LogConfigurator.configure(LogConfigurator.java:127)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:310)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.cli.Command.main(Command.java:90)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]:         at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92)
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]: 2019-11-15 08:55:07,342 main ERROR Null object returned for RollingFile in Appenders.
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]: 2019-11-15 08:55:07,343 main ERROR Null object returned for RollingFile in Appenders.
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]: 2019-11-15 08:55:07,344 main ERROR Unable to locate appender "rolling" for logger config "root"
Nov 15 08:55:07 Oneload-QADB elasticsearch[19819]: 2019-11-15 08:55:07,344 main ERROR Unable to locate appender "rolling_old" for logger config "root"
Nov 15 08:55:08 Oneload-QADB systemd[1]: elasticsearch.service: Main process exited, code=exited, status=1/FAILURE
Nov 15 08:55:08 Oneload-QADB systemd[1]: Failed to start Elasticsearch.
-- Subject: Unit elasticsearch.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit elasticsearch.service has failed.
-- 
-- The result is failed.
Nov 15 08:55:08 Oneload-QADB systemd[1]: elasticsearch.service: Unit entered failed state.
Nov 15 08:55:08 Oneload-QADB systemd[1]: elasticsearch.service: Failed with result 'exit-code'.
Nov 15 08:55:08 Oneload-QADB sudo[19780]: pam_unix(sudo:session): session closed for user root

Hi @rehannali

You have specified /var/log/elasticsearch as path for your logs. Can you please post the content of the most recent log file? Also, please post the content of your log4j2.properties file, as the logs indicate that something is wrong there?

@MiTschMR Thanks for the support. I fixed the issue. There was a problem with permission for path /var/log/elasticsearch. I fixed an issue with update permission for this folder and everything is working fine.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.