Troubleshoot Elasticsearch OpenTelemetry integration

How to check

$
sudo systemctl status otelcol-contrib

Resolution

• If the service is inactive, start it: sudo systemctl start otelcol-contrib

• If the service failed, fix configuration errors and restart: sudo systemctl restart otelcol-contrib

How to check

$
sudo journalctl -u otelcol-contrib.service -f

Resolution

Review the log output and resolve the root cause (for example, connection problems, authentication failures, or permission issues).

Error sample: dial tcp [::1]:9200: connect: connection refused

Resolution

• Ensure the endpoint in config.yaml matches the Elasticsearch host and port.

• Confirm Elasticsearch is running and reachable from the collector host.

Error sample: permanent error: 403 Forbidden

Resolution

• Verify NEWRELIC_LICENSE_KEY in /etc/systemd/system/otelcol-contrib.service.d/environment.conf.

• Reload systemd and restart the collector:

  bash

  Copier

  $
  sudo systemctl daemon-reload
  $
  sudo systemctl restart otelcol-contrib

Error sample: permission denied or cannot open file

Resolution

• Add the collector user to the Elasticsearch group:

  bash

  Copier

  $
  sudo usermod -a -G elasticsearch otelcol-contrib

• Restart the collector: sudo systemctl restart otelcol-contrib

How to check

$
# Unsecured cluster
$
curl -I http://localhost:9200
$

$
# With authentication
$
curl -u username:password -k https://localhost:9200

Resolution

Verify the cluster is healthy, credentials are valid, and firewall or security settings permit access.

Resolution

• Ensure the resourcedetection processor is included in every metrics pipeline.

• Verify elasticsearch.cluster.name is set via the resource/cluster_name_override processor.

Resolution

• Confirm filelog receiver paths are correct and absolute.

• Check that the logs pipeline includes both the filelog receiver and the otlphttp exporter.