elastic/elasticsearch · error · IllegalArgumentException

telemetry.logs.endpoint must be configured when telemetry.lo

Error message

telemetry.logs.endpoint must be configured when telemetry.logs.querylog.enabled=true

What it means

telemetry.logs.querylog.enabled has the same shape as the audit flag: its validator requires telemetry.logs.endpoint to be non-empty when querylog is true. endpoint defaults to empty, so enabling querylog without an endpoint is rejected at validation time (bootstrap or dynamic update).

Source

Thrown at modules/apm/src/main/java/org/elasticsearch/telemetry/apm/internal/export/otelsdk/OtelSdkSettings.java:249

            @Override
            public Iterator<Setting<?>> settings() {
                return List.<Setting<?>>of(TELEMETRY_LOGS_ENDPOINT).iterator();
            }
        },
        NodeScope
    );

    public static final Setting<Boolean> TELEMETRY_LOGS_QUERYLOG_ENABLED = Setting.boolSetting(
        "telemetry.logs.querylog.enabled",
        false,
        new Setting.Validator<>() {
            @Override
            public void validate(Boolean value) {}

            @Override
            public void validate(Boolean value, Map<Setting<?>, Object> settings) {
                if (value && ((String) settings.get(TELEMETRY_LOGS_ENDPOINT)).isEmpty()) {
                    throw new IllegalArgumentException(
                        TELEMETRY_LOGS_ENDPOINT.getKey() + " must be configured when telemetry.logs.querylog.enabled=true"
                    );
                }
            }

            @Override
            public Iterator<Setting<?>> settings() {
                return List.<Setting<?>>of(TELEMETRY_LOGS_ENDPOINT).iterator();
            }
        },
        NodeScope
    );

    /**
     * Maximum number of log records the {@code BatchLogRecordProcessor} buffers before dropping.
     * Sized for ~30 MB of in-flight records at ~3 KB/record average.
     */
    public static final Setting<Integer> TELEMETRY_LOGS_MAX_QUEUE_SIZE = Setting.intSetting(

View on GitHub (pinned to db6a809a66)

Solutions

1. Set telemetry.logs.endpoint to a valid OTLP endpoint alongside telemetry.logs.querylog.enabled: true.
2. Leave querylog disabled if no collector is configured.
3. When applying via update-settings, batch both keys in one call.

Example fix

// before
telemetry.logs.querylog.enabled: true
// after
telemetry.logs.querylog.enabled: true
telemetry.logs.endpoint: "https://otel-collector:4317"

// Pre-flight: querylog requires endpoint
static String check(Map<String,Object> s) {
  boolean q = Boolean.TRUE.equals(s.get("telemetry.logs.querylog.enabled"));
  String ep = (String) s.getOrDefault("telemetry.logs.endpoint", "");
  return (q && ep.isEmpty()) ? "set telemetry.logs.endpoint" : null;
}

When it happens

Trigger: Setting telemetry.logs.querylog.enabled: true without also setting telemetry.logs.endpoint.

Common situations: Enabling the slow-query log export feature without pointing at a collector; partial config rollout.

Related errors

• Configuration [{qualifiedKey}] is either prohibited or unkno
• telemetry.logs.endpoint must be configured when telemetry.lo
• telemetry.logs.ssl.certificate and telemetry.logs.ssl.key mu
• {thisSettingKey} ({value}) must be greater than {otherSettin
• Failed to initialise TLS context for OTel log export

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/d3b86120e4b9c5c9. Report an issue: GitHub.