Starting Elasticsearchedit
The method for starting Elasticsearch varies depending on how you installed it.
Archive packages (.tar.gz)edit
If you installed Elasticsearch with a .tar.gz package, you can start Elasticsearch from the
command line.
Running Elasticsearch from the command lineedit
Elasticsearch can be started from the command line as follows:
./bin/elasticsearch
If you have password-protected the Elasticsearch keystore, you will be prompted to enter the keystore’s password. See Secure settings for more details.
By default, Elasticsearch runs in the foreground, prints its logs to the
standard output (stdout), and can be stopped by pressing Ctrl-C.
All scripts packaged with Elasticsearch require a version of Bash
that supports arrays and assume that Bash is available at /bin/bash.
As such, Bash should be available at this path either directly or via a
symbolic link.
Running as a daemonedit
To run Elasticsearch as a daemon, specify -d on the command line, and record
the process ID in a file using the -p option:
./bin/elasticsearch -d -p pid
If you have password-protected the Elasticsearch keystore, you will be prompted to enter the keystore’s password. See Secure settings for more details.
Log messages can be found in the $ES_HOME/logs/ directory.
To shut down Elasticsearch, kill the process ID recorded in the pid file:
pkill -F pid
Archive packages (.zip)edit
If you installed Elasticsearch on Windows with a .zip package, you can start Elasticsearch from
the command line. If you want Elasticsearch to start automatically at boot time without
any user interaction, install Elasticsearch as a service.
Running Elasticsearch from the command lineedit
Elasticsearch can be started from the command line as follows:
.\bin\elasticsearch.bat
If you have password-protected the Elasticsearch keystore, you will be prompted to enter the keystore’s password. See Secure settings for more details.
By default, Elasticsearch runs in the foreground, prints its logs to STDOUT,
and can be stopped by pressing Ctrl-C.
Debian packagesedit
Elasticsearch is not started automatically after installation. How to start
and stop Elasticsearch depends on whether your system uses SysV init or
systemd (used by newer distributions). You can tell which is being used by
running this command:
ps -p 1
Running Elasticsearch with SysV initedit
Use the update-rc.d command to configure Elasticsearch to start automatically
when the system boots up:
sudo update-rc.d elasticsearch defaults 95 10
Elasticsearch can be started and stopped using the service command:
sudo -i service elasticsearch start sudo -i service elasticsearch stop
If Elasticsearch fails to start for any reason, it will print the reason for
failure to STDOUT. Log files can be found in /var/log/elasticsearch/.
Running Elasticsearch with systemdedit
To configure Elasticsearch to start automatically when the system boots up, run the following commands:
sudo /bin/systemctl daemon-reload sudo /bin/systemctl enable elasticsearch.service
Elasticsearch can be started and stopped as follows:
sudo systemctl start elasticsearch.service sudo systemctl stop elasticsearch.service
These commands provide no feedback as to whether Elasticsearch was started
successfully or not. Instead, this information will be written in the log
files located in /var/log/elasticsearch/.
If you have password-protected your Elasticsearch keystore, you will need to provide
systemd with the keystore password using a local file and systemd environment
variables. This local file should be protected while it exists and may be
safely deleted once Elasticsearch is up and running.
echo "keystore_password" > /path/to/my_pwd_file.tmp chmod 600 /path/to/my_pwd_file.tmp sudo systemctl set-environment ES_KEYSTORE_PASSPHRASE_FILE=/path/to/my_pwd_file.tmp sudo systemctl start elasticsearch.service
By default the Elasticsearch service doesn’t log information in the systemd
journal. To enable journalctl logging, the --quiet option must be removed
from the ExecStart command line in the elasticsearch.service file.
When systemd logging is enabled, the logging information are available using
the journalctl commands:
To tail the journal:
sudo journalctl -f
To list journal entries for the elasticsearch service:
sudo journalctl --unit elasticsearch
To list journal entries for the elasticsearch service starting from a given time:
sudo journalctl --unit elasticsearch --since "2016-10-30 18:17:16"
Check man journalctl or https://www.freedesktop.org/software/systemd/man/journalctl.html for
more command line options.
Docker imagesedit
If you installed a Docker image, you can start Elasticsearch from the command line. There are different methods depending on whether you’re using development mode or production mode. See Docker Run.
MSI packagesedit
If you installed Elasticsearch on Windows using the .msi package, you can start Elasticsearch
from the command line. If you want it to start automatically at boot time
without any user interaction,
install Elasticsearch as a Windows service.
Running Elasticsearch from the command lineedit
Once installed, Elasticsearch can be started from the command line, if not installed as a service and configured to start when installation completes, as follows:
.\bin\elasticsearch.exe
The command line terminal will display output similar to the following:
By default, Elasticsearch runs in the foreground, prints its logs to STDOUT in addition
to the <cluster name>.log file within LOGSDIRECTORY, and can be stopped by pressing Ctrl-C.
RPM packagesedit
Elasticsearch is not started automatically after installation. How to start
and stop Elasticsearch depends on whether your system uses SysV init or
systemd (used by newer distributions). You can tell which is being used by
running this command:
ps -p 1
Running Elasticsearch with SysV initedit
Use the chkconfig command to configure Elasticsearch to start automatically
when the system boots up:
sudo chkconfig --add elasticsearch
Elasticsearch can be started and stopped using the service command:
sudo -i service elasticsearch start sudo -i service elasticsearch stop
If Elasticsearch fails to start for any reason, it will print the reason for
failure to STDOUT. Log files can be found in /var/log/elasticsearch/.
Running Elasticsearch with systemdedit
To configure Elasticsearch to start automatically when the system boots up, run the following commands:
sudo /bin/systemctl daemon-reload sudo /bin/systemctl enable elasticsearch.service
Elasticsearch can be started and stopped as follows:
sudo systemctl start elasticsearch.service sudo systemctl stop elasticsearch.service
These commands provide no feedback as to whether Elasticsearch was started
successfully or not. Instead, this information will be written in the log
files located in /var/log/elasticsearch/.
If you have password-protected your Elasticsearch keystore, you will need to provide
systemd with the keystore password using a local file and systemd environment
variables. This local file should be protected while it exists and may be
safely deleted once Elasticsearch is up and running.
echo "keystore_password" > /path/to/my_pwd_file.tmp chmod 600 /path/to/my_pwd_file.tmp sudo systemctl set-environment ES_KEYSTORE_PASSPHRASE_FILE=/path/to/my_pwd_file.tmp sudo systemctl start elasticsearch.service
By default the Elasticsearch service doesn’t log information in the systemd
journal. To enable journalctl logging, the --quiet option must be removed
from the ExecStart command line in the elasticsearch.service file.
When systemd logging is enabled, the logging information are available using
the journalctl commands:
To tail the journal:
sudo journalctl -f
To list journal entries for the elasticsearch service:
sudo journalctl --unit elasticsearch
To list journal entries for the elasticsearch service starting from a given time:
sudo journalctl --unit elasticsearch --since "2016-10-30 18:17:16"
Check man journalctl or https://www.freedesktop.org/software/systemd/man/journalctl.html for
more command line options.