---
title: Troubleshoot Elasticsearch OpenTelemetry integration
source: https://docs.newrelic.com/docs/opentelemetry/integrations/elasticsearch/troubleshooting
---

If you have completed the [Elasticsearch OpenTelemetry integration installation](https://docs.newrelic.com/docs/opentelemetry/integrations/elasticsearch/elasticsearch-otel-integration-install) or [Kubernetes installation](https://docs.newrelic.com/docs/opentelemetry/integrations/elasticsearch/elasticsearch-otel-integration-k8-install) but don't see data in New Relic, find your issue below and follow the solution steps.

## Host-based deployments [#host-troubleshooting]

**Collector service stopped or failed**

How to check

````bash
sudo systemctl status otelcol-contrib
```
<p><strong>Resolution</strong></p>

- If the service is inactive, start it: <InlineCode>sudo systemctl start otelcol-contrib</InlineCode>
- If the service failed, fix configuration errors and restart: <InlineCode>sudo systemctl restart otelcol-contrib</InlineCode>

````

**Collector logs report scraping or export errors**

How to check

````bash
sudo journalctl -u otelcol-contrib.service -f
```
<p><strong>Resolution</strong></p>
<p>Review the log output and resolve the root cause (for example, connection problems, authentication failures, or permission issues).</p>

````

**Connection refused when calling Elasticsearch**

Error sample: `dial tcp ::1:9200: connect: connection refused`

Resolution

-   Ensure the `endpoint` in `config.yaml` matches the Elasticsearch host and port.
-   Confirm Elasticsearch is running and reachable from the collector host.

**403 Forbidden when exporting to New Relic**

Error sample: `permanent error: 403 Forbidden`

Resolution

1.  Verify `NEWRELIC_LICENSE_KEY` in `/etc/systemd/system/otelcol-contrib.service.d/environment.conf`.

2.  Reload systemd and restart the collector:
    ```bash
    sudo systemctl daemon-reload
    sudo systemctl restart otelcol-contrib
    ```

**Permission denied when collecting logs**

Error sample: `permission denied` or `cannot open file`

Resolution

1.  Add the collector user to the Elasticsearch group:
    ```bash
    sudo usermod -a -G elasticsearch otelcol-contrib
    ```
2.  Restart the collector: `sudo systemctl restart otelcol-contrib`

**Cannot reach the Elasticsearch API from the collector**

How to check

````bash
# Unsecured cluster
curl -I http://localhost:9200

# With authentication
curl -u username:password -k https://localhost:9200
```
<p><strong>Resolution</strong></p>
<p>Verify the cluster is healthy, credentials are valid, and firewall or security settings permit access.</p>

````

**Elasticsearch entity missing in New Relic UI**

Resolution

-   Ensure the `resourcedetection` processor is included in every metrics pipeline.
-   Verify `elasticsearch.cluster.name` is set via the `resource/cluster_name_override` processor.

**Metrics present but logs missing**

Resolution

-   Confirm `filelog` receiver paths are correct and absolute.
-   Check that the logs pipeline includes both the `filelog` receiver and the `otlphttp` exporter.

## Kubernetes deployments [#kubernetes-troubleshooting]

**No Elasticsearch pods discovered - missing labels**

How to check

````bash
# Verify your Elasticsearch pods have the required label
kubectl get pods -n <namespace> -l app=elasticsearch --show-labels
```
<p><strong>Resolution</strong></p>
<p>If no pods are returned, your Elasticsearch pods are missing the required <InlineCode>app=elasticsearch</InlineCode> label. The receiver_creator cannot discover pods without matching labels.</p>

* For StatefulSet/Deployment, add the label in the pod template:
  ```yaml
  spec:
    template:
      metadata:
        labels:
          app: elasticsearch
  ```
* For existing pods, add the label and restart:
  ```bash
  kubectl label pods -l <your-selector> app=elasticsearch -n <namespace>
  kubectl rollout restart statefulset/elasticsearch -n <namespace>
  ```
* If using custom labels, update the receiver rule in values.yaml to match your labels:
  ```yaml
  rule: type == "pod" && labels["app"] == "your-custom-label"
  ```

````

**Collector pods not running or crashing**

How to check

````bash
kubectl get pods -n newrelic
kubectl describe pod <collector-pod-name> -n newrelic
```
<p><strong>Resolution</strong></p>
<ul>
  <li>Check pod events for errors: <InlineCode>kubectl describe pod</InlineCode></li>

  <li>

  Review collector logs:

  ```bash
  kubectl logs -n newrelic -l app.kubernetes.io/name=opentelemetry-collector
  ```

  </li>

  <li>

  Verify the secret exists:

  ```bash
  kubectl get secret newrelic-licenses -n newrelic
  ```

  </li>

  <li>Check resource limits aren't too low</li>
</ul>

````

**Receiver creator cannot discover pods**

How to check

````bash
# Check collector logs for discovery errors
kubectl logs -n newrelic -l app.kubernetes.io/name=opentelemetry-collector | grep "receiver_creator"
```
<p><strong>Resolution</strong></p>
<ul>
  <li>

  Verify RBAC permissions are correctly set:

  ```bash
  kubectl get clusterrole | grep opentelemetry
  kubectl describe clusterrole <role-name>
  ```

  </li>

  <li>Ensure the collector has permissions to watch pods, nodes, and endpoints</li>

  <li>Check that k8s_observer extension is enabled in the config</li>
</ul>

````

**Collector cannot connect to Elasticsearch pods**

How to check

````bash
# Check network policies
kubectl get networkpolicies -n <namespace>

# Test connectivity from collector to Elasticsearch
kubectl exec -n newrelic <collector-pod> -- curl http://<es-pod-ip>:9200
```
<p><strong>Resolution</strong></p>
<ul>
  <li>Verify network policies allow traffic from the newrelic namespace to your Elasticsearch namespace</li>
  <li>Check if Elasticsearch pods are exposing the correct port (default: 9200)</li>
  <li>Ensure no firewall rules block inter-pod communication</li>
</ul>

````

**403 Forbidden or authentication errors in Kubernetes**

Error sample: `permanent error: 403 Forbidden`

Resolution

Verify the secret contains the correct license key:

````bash
kubectl get secret newrelic-licenses -n newrelic -o jsonpath='{.data.NEWRELIC_LICENSE_KEY}' | base64 -d
```


````

Ensure the OTLP endpoint is correct for your region

Check that the secret is mounted in the collector pod:

````bash
kubectl describe pod <collector-pod> -n newrelic | grep -A5 "Environment"
```


````

**Logs not being collected in Kubernetes**

Resolution

Verify you're using `mode: daemonset` (deployment mode cannot access node logs)

Check volume mounts are correctly configured:

````bash
kubectl describe pod <collector-pod> -n newrelic | grep -A10 "Mounts"
```


````

Verify the filelog receiver path matches your Elasticsearch pod logs:

````bash
kubectl exec -n newrelic <collector-pod> -- ls /var/log/pods/*/elasticsearch*/*.log
```


````

Ensure the collector has read permissions on host log directories

**Metrics missing k8s.cluster.name attribute**

Resolution

Verify `K8S_CLUSTER_NAME` environment variable is set in values.yaml

Check the `resource/cluster` processor is in the metrics pipeline

Query to verify:

````sql
FROM Metric SELECT * WHERE metricName LIKE 'elasticsearch.%' LIMIT 1
```

Check if <InlineCode>k8s.cluster.name</InlineCode> attribute is present


````