elastic/elasticsearch · error · IllegalArgumentException

telemetry.logs.endpoint must be configured when telemetry.lo

Error message

telemetry.logs.endpoint must be configured when telemetry.logs.audit.enabled=true

What it means

telemetry.logs.audit.enabled is a boolSetting whose validator (the two-arg form, evaluated against the resolved settings map) requires telemetry.logs.endpoint to be non-empty when audit is true. The single-arg validate is a no-op; only the cross-setting check fires. endpoint defaults to empty string, so enabling audit without explicitly pointing it at a collector always fails.

Source

Thrown at modules/apm/src/main/java/org/elasticsearch/telemetry/apm/internal/export/otelsdk/OtelSdkSettings.java:225

    );

    // --- Logs

    /** OTLP/gRPC endpoint URL where the SDK exports audit log records. Required when {@link #TELEMETRY_LOGS_AUDIT_ENABLED} is true. */
    public static final Setting<String> TELEMETRY_LOGS_ENDPOINT = Setting.simpleString("telemetry.logs.endpoint", "", NodeScope);

    /** Whether the OTel SDK audit-log export path is active. When false, {@link OtelSdkExportLogsSupplier} installs nothing. */
    public static final Setting<Boolean> TELEMETRY_LOGS_AUDIT_ENABLED = Setting.boolSetting(
        "telemetry.logs.audit.enabled",
        false,
        new Setting.Validator<>() {
            @Override
            public void validate(Boolean value) {}

            @Override
            public void validate(Boolean value, Map<Setting<?>, Object> settings) {
                if (value && ((String) settings.get(TELEMETRY_LOGS_ENDPOINT)).isEmpty()) {
                    throw new IllegalArgumentException(
                        TELEMETRY_LOGS_ENDPOINT.getKey() + " must be configured when telemetry.logs.audit.enabled=true"
                    );
                }
            }

            @Override
            public Iterator<Setting<?>> settings() {
                return List.<Setting<?>>of(TELEMETRY_LOGS_ENDPOINT).iterator();
            }
        },
        NodeScope
    );

    public static final Setting<Boolean> TELEMETRY_LOGS_QUERYLOG_ENABLED = Setting.boolSetting(
        "telemetry.logs.querylog.enabled",
        false,
        new Setting.Validator<>() {
            @Override

View on GitHub (pinned to db6a809a66)

Solutions

1. Set telemetry.logs.endpoint to a valid OTLP endpoint (e.g. https://collector:4317) before or together with telemetry.logs.audit.enabled: true.
2. If you do not have a collector, leave telemetry.logs.audit.enabled false (its default).
3. When using the cluster update API, send both keys in the same request body.

Example fix

// before
telemetry.logs.audit.enabled: true
// after
telemetry.logs.audit.enabled: true
telemetry.logs.endpoint: "https://otel-collector:4317"

// Pre-flight: audit requires endpoint
static String check(Map<String,Object> s) {
  boolean audit = Boolean.TRUE.equals(s.get("telemetry.logs.audit.enabled"));
  String ep = (String) s.getOrDefault("telemetry.logs.endpoint", "");
  return (audit && ep.isEmpty()) ? "set telemetry.logs.endpoint" : null;
}

When it happens

Trigger: Setting telemetry.logs.audit.enabled: true without also setting telemetry.logs.endpoint. Triggered at node bootstrap or via cluster update-settings when the new value is validated against its dependencies.

Common situations: Enabling the audit log export in config but forgetting the OTLP/gRPC endpoint; rotating endpoint to empty during a change; copying an audit config block that omitted the endpoint.

Related errors

• Configuration [{qualifiedKey}] is either prohibited or unkno
• telemetry.logs.endpoint must be configured when telemetry.lo
• telemetry.logs.ssl.certificate and telemetry.logs.ssl.key mu
• {thisSettingKey} ({value}) must be greater than {otherSettin
• Failed to initialise TLS context for OTel log export

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/23d1d497b91832a3. Report an issue: GitHub.