How to Auto Restart ElasticSearh service on failure

If ElasticSearh service crash on your server, you can auto restart it by modifying systemd service file.

systemctl edit elasticsearch

This will open an editor. In the file editor, paste the following text.

[Service]
Restart=always

Save and exit the editor. Restart elasticsearch service

systemctl restart elasticsearch

To verify ElasticSearch auto restart on failure, you can kill the process. To find the process ID, you can use the command “systemctl status elasticsearch”, it will show the current status and PID of ElasticSearch. After killing the process, check the status of ElasticSearch, you will see it auto-starting.

Monitor using cronjob

If you are not using systemd, you can use a cronjob to monitor ElasticSearch and restart in case of failure.

Create a file

mkdir /usr/serverok/
vi /usr/serverok/elasticsearch.sh

In the file, paste the following code

#!/bin/bash
# Author: ServerOK
# Web: https://serverok.in
# Auto restart ElasticSearch on failure.

CMD_RESULT="$(netstat -lntp | grep java | grep 9200)"
TIME_STAMP="$(date "+%Y-%m-%d %H:%M:%S")"

if [[ ! $CMD_RESULT == *"LISTEN"* ]];
then
    service elasticsearch restart
    echo -e "${TIME_STAMP} restarted\n"
fi

This script will check if port 9200 is open (elasticsearch default port). If you use a non-standard port, replace the port 9200 in the script with your elasticsearch port.

Make the script executable

chmod 755 /usr/serverok/elasticsearch.sh

Create a cronjob

crontab -e

Add

*/5 * * * * /usr/serverok/elasticsearch.sh >> /var/log/sok-elasticsearch.log

You can also use monit to auto restart Elastic Search. How to Auto restart ElasticSearch with monit

Check ElasticSearch Process is running

In the above method, we check if ElasticSearch listening on a port. Instead, you can check if the process is running or not. Use the following script to check if ElasticSearch process is running, if it crashed, then restart the service.

#!/bin/bash
# Author: ServerOK
# Web: https://serverok.in
# Auto restart ElasticSearch on crash.

TIME_STAMP="$(date "+%Y-%m-%d %H:%M:%S")"
CMD_RESULT="$(ps -ef | grep -v grep | grep elastic)"

if [[ -z $CMD_RESULT ]];
then
    systemctl restart elasticsearch
    echo -e "${TIME_STAMP} restarted\n"
fi

NOTE: when you use this method, make sure you don’t name the script with name elastic as the script itself shows when you check if elasticsearch is running. So name this script with some generic name, example monitor-es.sh

Check ElasticSearch status with systemctl

#!/bin/bash

CMD_RESULT="$(systemctl status elasticsearch.service | grep 'Active' | egrep 'running|dead|failed' | awk '{print $2}' | sed 's/[()]//g')"
TIME_STAMP="$(date "+%Y-%m-%d %H:%M:%S")"

if [[ ! $CMD_RESULT == "running" ]];
then
    systemctl restart elasticsearch
    echo -e "${TIME_STAMP} restarted\n"
#    echo 'elasticsearch restarted' | mail -s 'elasticsearch restarted' [email protected]
fi

Back to ElasticSearch