{"record":{"id":"23d1d497b91832a3","repo":"elastic/elasticsearch","slug":"telemetry-logs-endpoint-must-be-configured-when-te","errorCode":null,"errorMessage":"telemetry.logs.endpoint must be configured when telemetry.logs.audit.enabled=true","messagePattern":"telemetry\\.logs\\.endpoint must be configured when telemetry\\.logs\\.audit\\.enabled=true","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/apm/src/main/java/org/elasticsearch/telemetry/apm/internal/export/otelsdk/OtelSdkSettings.java","lineNumber":225,"sourceCode":"    );\n\n    // --- Logs\n\n    /** OTLP/gRPC endpoint URL where the SDK exports audit log records. Required when {@link #TELEMETRY_LOGS_AUDIT_ENABLED} is true. */\n    public static final Setting<String> TELEMETRY_LOGS_ENDPOINT = Setting.simpleString(\"telemetry.logs.endpoint\", \"\", NodeScope);\n\n    /** Whether the OTel SDK audit-log export path is active. When false, {@link OtelSdkExportLogsSupplier} installs nothing. */\n    public static final Setting<Boolean> TELEMETRY_LOGS_AUDIT_ENABLED = Setting.boolSetting(\n        \"telemetry.logs.audit.enabled\",\n        false,\n        new Setting.Validator<>() {\n            @Override\n            public void validate(Boolean value) {}\n\n            @Override\n            public void validate(Boolean value, Map<Setting<?>, Object> settings) {\n                if (value && ((String) settings.get(TELEMETRY_LOGS_ENDPOINT)).isEmpty()) {\n                    throw new IllegalArgumentException(\n                        TELEMETRY_LOGS_ENDPOINT.getKey() + \" must be configured when telemetry.logs.audit.enabled=true\"\n                    );\n                }\n            }\n\n            @Override\n            public Iterator<Setting<?>> settings() {\n                return List.<Setting<?>>of(TELEMETRY_LOGS_ENDPOINT).iterator();\n            }\n        },\n        NodeScope\n    );\n\n    public static final Setting<Boolean> TELEMETRY_LOGS_QUERYLOG_ENABLED = Setting.boolSetting(\n        \"telemetry.logs.querylog.enabled\",\n        false,\n        new Setting.Validator<>() {\n            @Override","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/apm/src/main/java/org/elasticsearch/telemetry/apm/internal/export/otelsdk/OtelSdkSettings.java#L207-L243","documentation":"telemetry.logs.audit.enabled is a boolSetting whose validator (the two-arg form, evaluated against the resolved settings map) requires telemetry.logs.endpoint to be non-empty when audit is true. The single-arg validate is a no-op; only the cross-setting check fires. endpoint defaults to empty string, so enabling audit without explicitly pointing it at a collector always fails.","triggerScenarios":"Setting telemetry.logs.audit.enabled: true without also setting telemetry.logs.endpoint. Triggered at node bootstrap or via cluster update-settings when the new value is validated against its dependencies.","commonSituations":"Enabling the audit log export in config but forgetting the OTLP/gRPC endpoint; rotating endpoint to empty during a change; copying an audit config block that omitted the endpoint.","solutions":["Set telemetry.logs.endpoint to a valid OTLP endpoint (e.g. https://collector:4317) before or together with telemetry.logs.audit.enabled: true.","If you do not have a collector, leave telemetry.logs.audit.enabled false (its default).","When using the cluster update API, send both keys in the same request body."],"exampleFix":"// before\ntelemetry.logs.audit.enabled: true\n// after\ntelemetry.logs.audit.enabled: true\ntelemetry.logs.endpoint: \"https://otel-collector:4317\"","handlingStrategy":"validation","validationCode":"// Pre-flight: audit requires endpoint\nstatic String check(Map<String,Object> s) {\n  boolean audit = Boolean.TRUE.equals(s.get(\"telemetry.logs.audit.enabled\"));\n  String ep = (String) s.getOrDefault(\"telemetry.logs.endpoint\", \"\");\n  return (audit && ep.isEmpty()) ? \"set telemetry.logs.endpoint\" : null;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat telemetry.logs.endpoint as required whenever audit or querylog is enabled.","When using cluster update-settings, send endpoint and the boolean flag in the same request."],"tags":["apm","telemetry","configuration","validation","audit"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}