Elasticsearch problem

Hi,
Can someone help me resolve this issue please. Thanks in advance!

“could not find java”

What is the result of using the command:

java -version

Not required but also set JAVA_HOME to point properly.

java -version

-bash: java : java command not found

…
If you can’t use the command, either java is not installed or your env doesn’t have a path to it…

Weird !!! graylog server (version 2.5, os centos7) has been in production for a year !! I I didn’t understand this error !!!

Check to see it JAVA_HOME is set in /etc/default/elasticsearch

vi /usr/share/elasticsearch/bin

systemctl status elasticseach.service

screenshots make me squint. You can use the tools in your reply to post relevant code so it looks like this:

################################
# Elasticsearch
################################

# Elasticsearch home directory
#ES_HOME=/usr/share/elasticsearch

# Elasticsearch Java path
JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64/

# Elasticsearch configuration directory
ES_PATH_CONF=/etc/elasticsearch

# Elasticsearch PID directory
#PID_DIR=/var/run/elasticsearch

That is the first couple of lines from my /etc/default/elasticsearch file… where I have:

JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64/

1 Like

I use graylog 2.5

Can’t. Read. Screenshot.

eyes

tooooo

squinty!

Since we are troubleshooting elasticsearch not starting for lack of knowing where java is installed… the graylog version isn’t particularly relevant… I have Ubuntu so locations MIGHT be different…

do some research about telling elasticsearch where java is:

https://www.elastic.co/guide/en/elasticsearch/reference/6.8/setup.html

so sorry, in centos 7, **/etc/sysconfig/elasticsearch**

If you are going to post code - use the </> tool in the tool bar.
image
Select the code you pasted in then use the </> tool. It makes it easier for everyone to read

in /etc/sysconfig/elasticsearch JAVA_HOME is commented out… If your file were to match the code I posted earlier, you would uncomment it by removing the # and put the path to your java directory in there… similarly to what I posted above… but not exactly… unless your java installation is in the exact same place as mine.

# Elasticsearch Java path
JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64/
1 Like
# Elasticsearch home directory
#ES_HOME=/usr/share/elasticsearch

# Elasticsearch Java path
 JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64/

# Elasticsearch configuration directory
ES_PATH_CONF=/etc/elasticsearch

# Elasticsearch PID directory
#PID_DIR=/var/run/elasticsearch

# Additional Java OPTS
#ES_JAVA_OPTS=

@tmacgbay
Notice, that, I didn’t touch any config, suddenly the graylog server doesn’t work, the server is in prod :pensive:

# systemctl status elasticsearch.service 
    elasticsearch[2856] : which: no java in ( /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin)
    elasticsearch[2856]: warning: Falling back to jaba on path. This behavior is deprecated. Specify JAVA_HOME
    elasticsearch[2856]: could not fin java; set JAVA_HOME
    systemd [1]: elasticsearch.service: main process exited , code=exited, status=1/FAILURE
    systemd[1]: Unit elasticsearch.service entered failed state.
    systemd[1]: elasticsearch.service failed
# tail -f /var/log/graylog-server/server.log
INFO [LookupTablesService] Cache otx-api-ip-cache/5caf0aee63404167aa951d7e [@6ff56e5a] TERMINATED, was STOPPING
INFO [LookupTablesService] Cache threat-intel-uncached-adapters/5caf0aee6304167aa51d81 [@73ÂŁ2063c] TERMINATED, was STOPPING
INFO [LookupTablesService] Data Adapter whois/5caf0aee63404167aa951d84 [@5a0aef1d] TERMINATED, was STOPPING
INFO [LookupTablesService]  Data Adapter abuse-ch-ransomware-domains/5caf0aee6340417aa9517ÂŁ...........
INFO [LogManager] Shutdown complete.
INFO [NetworkListener] Stoped listener bound to [@ip of my graylog server:9000]
INFO [ServiceManagerListener] Services are now stopped.

-------------------------------------------------------------------------------- @tmacgbay
# export | grep JAVA_HOME
declare -x JAVA_HOME="/usr/java/jdk1.8.0/"
# export | grep JRE_HOME
declare -x JRE_HOME="/usr/java/jdk1.8.0_/jre"

YES !!! Problem solved , thnaks a lot @tmacgbay

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.