Unable to Start Elasticserach

Elastic Stack Elasticsearch
1

Hi I can't turn on elasticsearch services after enabling xpack.security.enable : true and changing master account password. And I tried to disable the xpack but elasticsearch still can't run

Here's the journalctl -xe

-- Unit elasticsearch.service has failed.
--
-- The result is failed.
Jul 28 10:39:34 dev-elk-app-wb systemd[1]: Unit elasticsearch.service entered failed state.
Jul 28 10:39:34 dev-elk-app-wb systemd[1]: elasticsearch.service failed.
Jul 28 10:39:34 dev-elk-app-wb polkitd[1293]: Unregistered Authentication Agent for unix-process:7987:590816411 (system bus name :1.23583
Jul 28 10:40:01 dev-elk-app-wb systemd[1]: Created slice User Slice of root.
-- Subject: Unit user-0.slice has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit user-0.slice has finished starting up.
--
-- The start-up result is done.
Jul 28 10:40:01 dev-elk-app-wb systemd[1]: Started Session 11630 of user root.
-- Subject: Unit session-11630.scope has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit session-11630.scope has finished starting up.
--
-- The start-up result is done.
Jul 28 10:40:01 dev-elk-app-wb CROND[8245]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Jul 28 10:40:01 dev-elk-app-wb systemd[1]: Removed slice User Slice of root.
-- Subject: Unit user-0.slice has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit user-0.slice has finished shutting down.
Jul 28 10:41:56 dev-elk-app-wb sshd[7866]: pam_unix(sshd:session): session closed for user userdev
Jul 28 10:41:56 dev-elk-app-wb systemd-logind[1300]: Removed session 11629.
-- Subject: Session 11629 has been terminated
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat
--
-- A session with the ID 11629 has been terminated.

and this elasticsearch.log

[2022-07-28T10:39:13,796][INFO ][o.e.g.DanglingIndicesState] [node-1] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2022-07-28T10:39:14,371][INFO ][o.e.n.Node               ] [node-1] initialized
[2022-07-28T10:39:14,371][INFO ][o.e.n.Node               ] [node-1] starting ...
[2022-07-28T10:39:14,389][INFO ][o.e.x.s.c.f.PersistentCache] [node-1] persistent cache index loaded
[2022-07-28T10:39:34,519][INFO ][o.e.t.TransportService   ] [node-1] publish_address {10.0.118.12:9300}, bound_addresses {[::]:9300}
[2022-07-28T10:39:34,667][INFO ][o.e.n.Node               ] [node-1] stopping ...
[2022-07-28T10:39:34,680][INFO ][o.e.n.Node               ] [node-1] stopped
[2022-07-28T10:39:34,680][INFO ][o.e.n.Node               ] [node-1] closing ...
[2022-07-28T10:39:34,692][INFO ][o.e.n.Node               ] [node-1] closed
[2022-07-28T10:39:34,694][INFO ][o.e.x.m.p.NativeController] [node-1] Native controller process has stopped - no new native processes can be started
2

This suggests that Elasticsearch is trying to start, but then something asks it to shut down.

3

New log

-- Unit elasticsearch.service has begun starting up.
Jul 28 11:36:25 dev-elk-app-wb systemd[1]: elasticsearch.service start operation timed out. Terminating.
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: uncaught exception in thread [main]
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: java.security.AccessControlException: access denied ("java.lang.RuntimePermissio
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at java.base/java.security.AccessControlContext.checkPermission(AccessControlCon
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at java.base/java.security.AccessController.checkPermission(AccessController.jav
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:408)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at java.base/java.lang.ClassLoader.checkClassLoaderPermission(ClassLoader.java:2
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at java.base/java.lang.ClassLoader.getParent(ClassLoader.java:1799)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.locateConte
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContex
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContex
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.apache.logging.log4j.LogManager.getContext(LogManager.java:174)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:648)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.apache.logging.log4j.LogManager.getRootLogger(LogManager.java:682)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:420)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.cli.Command.main(Command.java:79)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:81)
Jul 28 11:36:25 dev-elk-app-wb systemd-entrypoint[8907]: For complete error details, refer to the log at /var/log/elasticsearch/BSI.log
Jul 28 11:36:26 dev-elk-app-wb systemd[1]: Failed to start Elasticsearch.
-- Subject: Unit elasticsearch.service has failed
4

That is cut off, so you need to check the log file it mentions at the end of the error.