Elasticsearch can't write to log files

Question

I would like to activate logs of elasticsearch .

When I run elasticsearch binaries, I realize that I have problems with logging : the configuration cannot be loaded !

Answer 1

If you have installed elasticsearch in Debian systems using dpkg, the default configuration can be found at /etc/elasticsearch/

You will have 2 yml files:

• elasticsearch.yml
• logging.yml

You can edit the elasticsearch file (changing access right or copying file into your main elasticsearch directory). To configure your log path (l.167).

    #path.logs: /path/to/logs
    #e.g:        
    path.logs: /usr/share/elasticsearch/logs

Make sure you have right access on it. Then try

    cd /usr/share/elasticsearch/ 
    bin/elasticsearch start

and check the publish_adress given in terminal

You can also define more parameters. Hope this help.

Answer 2

I think that you have installed your elasticsearch using yum or apt-get The best way of doing this is by typing:

$ sudo service elasticsearch start

or anything similar, like the way you would start services like nginx, etc.

It works for me.

Answer 3

If you have installed a .deb and want to start sudo /usr/share/elasticsearch/bin/elasticsearch

You have to do :

cd /usr/share/elasticsearch

sudo ln -s /etc/elasticsearch config

Answer 4

If you need to run it in foreground, but not as service just specify configuration directory explicitly.

$ /usr/share/elasticsearch/bin/elasticsearch -Des.path.conf=/etc/elasticsearch

In this case elasticsearch will be able to find all your config files.

Answer 5

In my case I was trying to start elasticsearch from the tar download so that I can run multiple separate instances easily without service definitions.

What worked for me was to go up a directory and launch elasticsearch using bin/elasticsearch instead of just elasticsearch while being in the bin directory.

Now it started up no problem without any symlinks, service files, or other changes.

Answer 6

If you installed elasticsearch using a package manager like yum or apt-get you should not start elasticsearch this way. Try to use the service: for instance /etc/init.d/elasticsearch or using the command sudo service elasticsearch start

You should also check if the logging.yml file is at the location mentioned in the stack trace:/usr/share/elasticsearch/config

Using sudo to start elasticsearch is not good, you could do sudo elasticsearch to run as the elasticsearch user, but I prefer to use the service call as described in the second sentence.

Hope that helps