If you installed elasticsearch using a package manager like yum or apt-get you should not start elasticsearch this way. Try to use the service: for instance /etc/init.d/elasticsearch or using the command sudo service elasticsearch start You should also check if the logging.yml file is at the location mentioned in the stack trace: /usr/share/elasticsearch/config Using sudo to start elasticsearch is not good, you could do sudo elasticsearch to run as the elasticsearch user, but I prefer to use the service call as described in the second sentence.