# When installing ElasticFlow 7.5, get fatal exception while bootstraping Elasticsearch

**URL:** <https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869>\
**Category:** Elasticsearch\
**Created:** [January 6, 2025, 10:41pm UTC](https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869 "2025-01-06T22:41:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tallguy86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tallguy86/32/140517_2.png) [@tallguy86](https://discuss.elastic.co/u/tallguy86)\
**Post date:** [January 6, 2025, 10:41pm UTC](https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869/1 "2025-01-06T22:41:44Z")

</div>

When following the install guide for Elasticsearch for Red Hat, Install Elasticsearch, 7. Edit elasticsearch.yml:

I am being told that the config is enough to get started for a single node so I deleted all lines and pasted in

```auto
cluster.name: elastiflow

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

bootstrap.memory_lock: true

network.host: 0.0.0.0
http.port: 9200

discovery.type: 'single-node'

indices.query.bool.max_clause_count: 8192
search.max_buckets: 250000

action.destructive_requires_name: 'true'

xpack.security.http.ssl.enabled: 'true'
xpack.security.http.ssl.verification_mode: 'none'
xpack.security.http.ssl.certificate_authorities: /etc/elasticsearch/certs/ca/ca.crt
xpack.security.http.ssl.key: /etc/elasticsearch/certs/myhost/myhost.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/certs/myhost/myhost.crt

xpack.monitoring.enabled: 'true'
xpack.monitoring.collection.enabled: 'true'
xpack.monitoring.collection.interval: 30s

xpack.security.enabled: 'true'
xpack.security.audit.enabled: 'false'

```

I then added my config for my environment:

```auto
cluster.name: ipr-ost-netflow-c1

path.data: /netflow/var/lib/elasticsearch
path.logs: /netflow/var/log/elasticsearch

bootstrap.memory_lock: true

network.host: 0.0.0.0
http.port: 9200

discovery.type: 'single-node'

indices.query.bool.max_clause_count: 8192
search.max_buckets: 250000

action.destructive_requires_name: 'true'

xpack.security.http.ssl.enabled: 'true'
xpack.security.http.ssl.verification_mode: 'none'
xpack.security.http.ssl.certificate_authorities: /etc/elasticsearch/certs/ca/ca.crt
xpack.security.http.ssl.key: /etc/elasticsearch/certs/ipr-ost-netflow/ipr-ost-netflow.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/certs/ipr-ost-netflow/ipr-ost-netflow.crt

xpack.monitoring.enabled: 'true'

xpack.security.enabled: 'true'
xpack.security.audit.enabled: 'false'

```

On 8. Enable and Start Elasticsearch

I run the commands

> sudo systemctl daemon-reload &&   
> sudo systemctl enable elasticsearch &&   
> sudo systemctl start elasticsearch

The daemon fails to start and the only error message in the log is:

```auto
[2025-01-06T17:07:20,170][ERROR][o.e.b.Elasticsearch] [ipr-ost-netflow] fatal exception while booting Elasticsearch
java.lang.IllegalArgumentException: unknown setting [xpack.monitoring.enabled] did you mean any of [xpack.profiling.enabled, xpack.monitoring.templates.enabled]?
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:564) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:510) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:480) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:450) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.common.settings.SettingsModule.<init>(SettingsModule.java:133) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.common.settings.SettingsModule.<init>(SettingsModule.java:51) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.node.NodeConstruction.validateSettings(NodeConstruction.java:530) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.node.NodeConstruction.prepareConstruction(NodeConstruction.java:280) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.node.Node.<init>(Node.java:200) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch$2.<init>(Elasticsearch.java:247) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch.initPhase3(Elasticsearch.java:247) ~[elasticsearch-8.17.0.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:76) ~[elasticsearch-8.17.0.jar:?]

```

```auto
df -h /netflow/

Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VG_00-lv_netflow 1007G 480K 956G 1% /netflow

ls -la /netflow/

drwxr-xr-x 4 elasticsearch elasticsearch 4096 Jan 6 16:57 var

ls -la /netflow/var

drwxr-xr-x 3 elasticsearch elasticsearch 4096 Jan 6 16:50 lib
drwxr-xr-x 3 elasticsearch elasticsearch 4096 Jan 6 16:57 log

```

```auto
cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="8.10 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.10 (Ootpa)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:8::baseos"

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 6, 2025, 11:14pm UTC](https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869/2 "2025-01-06T23:14:22Z")

</div>

Hi @tallguy86 Welcome to the community!

Apologies But I'm pretty confused.

Your title says you're trying to start elasticsearch 7.5.

But your error Trace clearly shows 8.17.

`~[elasticsearch-8.17.0.jar`

Which means you're starting the 8.17 distribution.

So what are you trying to do?

Tell us from the high level what you're trying to do and perhaps we can get you started.

And I would advise please don't use 7.5 it is truly ancient.  
.  
If you need to use 7.x at least use 7.17 latest

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [January 7, 2025, 12:05am UTC](https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869/3 "2025-01-07T00:05:52Z")

</div>

> [@tallguy86](#):
>
> `xpack.monitoring.enabled`

“This deprecated setting has no effect.” Is in an earlier version of the docs.

Deprecated in 7.8, now seems to throw an error.

You wrote “I am being told …”. I’m sure whoever is telling you means well, but try to check and validate what you are told. They perhaps had a working config for 7.something, if you really really really must use that version then do, otherwise you need check the current (8.17.0) docs against what you need/want.

---

<div class="post-metadata">

**Author:** ![tallguy86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tallguy86/32/140517_2.png) [@tallguy86](https://discuss.elastic.co/u/tallguy86)\
**Post date:** [January 7, 2025, 12:27am UTC](https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869/4 "2025-01-07T00:27:59Z")

</div>

Sorry for the version confusion. I am following the Elasticsearch guide from the ElasticFlow (7.5) website so I might be using an outdated guide.

```auto
/usr/share/elasticsearch/bin/elasticsearch --version
Version: 8.17.0, Build: rpm/2b6a7fed44faa321997703718f07ee0420804b41/2024-12-11T12:08:05.663969764Z, JVM: 23

```

---

<div class="post-metadata">

**Author:** ![tallguy86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tallguy86/32/140517_2.png) [@tallguy86](https://discuss.elastic.co/u/tallguy86)\
**Post date:** [January 7, 2025, 1:26am UTC](https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869/5 "2025-01-07T01:26:15Z")

</div>

Disregard. I used the out-of-the-box elasticsearch.yml config and it started up.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 7, 2025, 2:46am UTC](https://discuss.elastic.co/t/when-installing-elasticflow-7-5-get-fatal-exception-while-bootstraping-elasticsearch/372869/6 "2025-01-07T02:46:40Z")

</div>

> [@tallguy86](#):
>
> Disregard. I used the out-of-the-box elasticsearch.yml config and it started up

Yup Right thing to do...

Use our docs too...