Upgrade 8.19.13 and errors starting regarding entitlement

Elastic Stack Elasticsearch
1

Hi,

We are facing issue starting the elasticsearch with version 8.19.13 showing this error message:

[2026-04-16T15:15:34,195][INFO ][o.e.n.NativeAccess ] Using native vector library; to disable start with -Dorg.elasticsearch.nativeaccess.enableVectorLibrary=false
[2026-04-16T15:15:34,205][INFO ][o.e.n.NativeAccess ] Using [jdk] native provider and native methods for [Linux]
[2026-04-16T15:15:34,282][INFO ][o.a.l.i.v.PanamaVectorizationProvider] [data1-hot-elk] Java vector incubator API enabled; uses preferredBitSize=256; FMA enabled
[2026-04-16T15:15:34,319][INFO ][o.e.b.Elasticsearch ] Bootstrapping Entitlements
[2026-04-16T15:15:35,972][ERROR][o.e.b.Elasticsearch ] fatal exception while booting Elasticsearch
java.lang.IllegalArgumentException: policy for module [io.netty.common] in [repository-azure] has an invalid file entitlement. Any path under [/opt/elasticsearch/modules] is forbidden for mode [READ].
at org.elasticsearch.entitlement.bootstrap.FilesEntitlementsValidation.buildValidationException(FilesEntitlementsValidation.java:63) ~[elasticsearch-entitlement-8.19.13.jar:?]
at org.elasticsearch.entitlement.bootstrap.FilesEntitlementsValidation.validateReadFilesEntitlements(FilesEntitlementsValidation.java:82) ~[elasticsearch-entitlement-8.19.13.jar:?]
at org.elasticsearch.entitlement.bootstrap.FilesEntitlementsValidation.validate(FilesEntitlementsValidation.java:49) ~[elasticsearch-entitlement-8.19.13.jar:?]
at org.elasticsearch.entitlement.bootstrap.EntitlementBootstrap.createPolicyManager(EntitlementBootstrap.java:181) ~[elasticsearch-entitlement-8.19.13.jar:?]
at org.elasticsearch.entitlement.bootstrap.EntitlementBootstrap.bootstrap(EntitlementBootstrap.java:104) ~[elasticsearch-entitlement-8.19.13.jar:?]
at org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:254) ~[elasticsearch-8.19.13.jar:?]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:99) ~[elasticsearch-8.19.13.jar:?]

Can you guide us how we could fix it, please?

Best regards,

Juan Carlos

2

That stack trace points at repository-azure, not the core 8.19.13 startup path. I’d check first whether this node still has an older or manually-copied repository-azure module/plugin layout under /opt/elasticsearch/modules, because the entitlement check is rejecting a read from there during bootstrap.

Fastest test is to start from a clean 8.19.13 install and bring back only config/data, not the old modules/ or plugins/ directories. If it boots cleanly, reinstall the Azure repository bits from the matching 8.19.13 package instead of carrying them forward. If you already did a clean install, I’d also look for a leftover custom entitlement patch tied to that module.

3

Hi,

Finally I found the issue and fixed it. My upgrade was from 8.6.2 to 8.19.13, my config files were out of config official folder (previous installation). I put my config files and certificates under the config folder and suddenly the elasticsearch started without problems.

Thanks anyway,

Juan Carlos

1 Like