/var/run/elasticsaerch has incorrect owner on reboot

Elastic Stack Elasticsearch
1

Hey everyone,

We run elasticsearch as a different user so we have the /etc/systemd/system/elasticsearch.service.d/override.conf in place with the user we run the service as.

The problem is every time we reboot our nodes the /var/run/elasticsearch directory is created and owned by elasticsearch:elasticsearch causing the service to not start because its not owned by the user we are running the service as. Does the override file not catch this directory or did I miss a step somewhere about config for this directory?

Any help would be awesome!

2

I found the answer after looking for different ways to own the folder at startup. Turns out there is /usr/lib/tmpfiles.d/elasticsearch.conf that needs to be changed if you run as a different user.

But then the question becomes why is the override file not covering this?