Not sure if this is just my config or something in the puppet module or in the Debian package of Elasticsearch 6.3.0 but when I just upgraded the owner of /etc/elasticsearch changed to root.elasticsearch
It was easily fixed using chown -R but just wanted to flag.