---
title: Troubleshoot Elasticsearch OpenTelemetry integration
source: https://docs.newrelic.com/docs/opentelemetry/integrations/elasticsearch/troubleshooting
---

If you have completed the [Elasticsearch OpenTelemetry integration installation](https://docs.newrelic.com/docs/opentelemetry/integrations/elasticsearch/elasticsearch-otel-integration-install) or [Kubernetes installation](https://docs.newrelic.com/docs/opentelemetry/integrations/elasticsearch/elasticsearch-otel-integration-k8-install) but don't see data in New Relic, find your issue below and follow the solution steps.

## Host-based deployments [#host-troubleshooting]

**Collector service stopped or failed**

How to check

````bash
sudo systemctl status otelcol-contrib
```
<p><strong>Resolution</strong></p>

- If the service is inactive, start it: <InlineCode>sudo systemctl start otelcol-contrib</InlineCode>
- If the service failed, fix configuration errors and restart: <InlineCode>sudo systemctl restart otelcol-contrib</InlineCode>

````

**Collector logs report scraping or export errors**

How to check

````bash
sudo journalctl -u otelcol-contrib.service -f
```
<p><strong>Resolution</strong></p>
<p>Review the log output and resolve the root cause (for example, connection problems, authentication failures, or permission issues).</p>

````

**Connection refused when calling Elasticsearch**

Error sample: `dial tcp ::1:9200: connect: connection refused`

Resolution

-   Ensure the `endpoint` in `config.yaml` matches the Elasticsearch host and port.
-   Confirm Elasticsearch is running and reachable from the collector host.

**403 Forbidden when exporting to New Relic**

Error sample: `permanent error: 403 Forbidden`

Resolution

1.  Verify `NEWRELIC_LICENSE_KEY` in `/etc/systemd/system/otelcol-contrib.service.d/environment.conf`.

2.  Reload systemd and restart the collector:
    ```bash
    sudo systemctl daemon-reload
    sudo systemctl restart otelcol-contrib
    ```

**Permission denied when collecting logs**

Error sample: `permission denied` or `cannot open file`

Resolution

1.  Add the collector user to the Elasticsearch group:
    ```bash
    sudo usermod -a -G elasticsearch otelcol-contrib
    ```
2.  Restart the collector: `sudo systemctl restart otelcol-contrib`

**Cannot reach the Elasticsearch API from the collector**

How to check

````bash
# Unsecured cluster
curl -I http://localhost:9200

# With authentication
curl -u username:password -k https://localhost:9200
```
<p><strong>Resolution</strong></p>
<p>Verify the cluster is healthy, credentials are valid, and firewall or security settings permit access.</p>

````

**Elasticsearch entity missing in New Relic UI**

Resolution

-   Ensure the `resourcedetection` processor is included in every metrics pipeline.
-   Verify `elasticsearch.cluster.name` is set via the `resource/cluster_name_override` processor.

**Metrics present but logs missing**

Resolution

-   Confirm `filelog` receiver paths are correct and absolute.
-   Check that the logs pipeline includes both the `filelog` receiver and the `otlphttp` exporter.

## Kubernetes deployments [#kubernetes-troubleshooting]

**No Elasticsearch pods discovered - missing labels**

How to check

````bash
# Verify your Elasticsearch pods have the required label
kubectl get pods -n <namespace> -l app=elasticsearch --show-labels
```
<p><strong>Resolution</strong></p>
<p>If no pods are returned, your Elasticsearch pods are missing the required <InlineCode>app=elasticsearch</InlineCode> label. The receiver_creator cannot discover pods without matching labels.</p>

* For StatefulSet/Deployment, add the label in the pod template:
  ```yaml
  spec:
    template:
      metadata:
        labels:
          app: elasticsearch
  ```
* For existing pods, add the label and restart:
  ```bash
  kubectl label pods -l <your-selector> app=elasticsearch -n <namespace>
  kubectl rollout restart statefulset/elasticsearch -n <namespace>
  ```
* If using custom labels, update the receiver rule in values.yaml to match your labels:
  ```yaml
  rule: type == "pod" && labels["app"] == "your-custom-label"
  ```

````

**Collector pods not running or crashing**

How to check

````bash
kubectl get pods -n newrelic
kubectl describe pod <collector-pod-name> -n newrelic
```
<p><strong>Resolution</strong></p>
<ul>
  <li>Check pod events for errors: <InlineCode>kubectl describe pod</InlineCode></li>

  <li>

  Review collector logs:

  ```bash
  kubectl logs -n newrelic -l app.kubernetes.io/name=opentelemetry-collector
  ```

  </li>

  <li>

  Verify the secret exists:

  ```bash
  kubectl get secret newrelic-licenses -n newrelic
  ```

  </li>

  <li>Check resource limits aren't too low</li>
</ul>

````

**Receiver creator cannot discover pods**

How to check

````bash
# Check collector logs for discovery errors
kubectl logs -n newrelic -l app.kubernetes.io/name=opentelemetry-collector | grep "receiver_creator"
```
<p><strong>Resolution</strong></p>
<ul>
  <li>

  Verify RBAC permissions are correctly set:

  ```bash
  kubectl get clusterrole | grep opentelemetry
  kubectl describe clusterrole <role-name>
  ```

  </li>

  <li>Ensure the collector has permissions to watch pods, nodes, and endpoints</li>

  <li>Check that k8s_observer extension is enabled in the config</li>
</ul>

````

**Collector cannot connect to Elasticsearch pods**

How to check

````bash
# Check network policies
kubectl get networkpolicies -n <namespace>

# Test connectivity from collector to Elasticsearch
kubectl exec -n newrelic <collector-pod> -- curl http://<es-pod-ip>:9200
```
<p><strong>Resolution</strong></p>
<ul>
  <li>Verify network policies allow traffic from the newrelic namespace to your Elasticsearch namespace</li>
  <li>Check if Elasticsearch pods are exposing the correct port (default: 9200)</li>
  <li>Ensure no firewall rules block inter-pod communication</li>
</ul>

````

**403 Forbidden or authentication errors in Kubernetes**

Error sample: `permanent error: 403 Forbidden`

Resolution

Verify the secret contains the correct license key:

````bash
kubectl get secret newrelic-licenses -n newrelic -o jsonpath='{.data.NEWRELIC_LICENSE_KEY}' | base64 -d
```


````

Ensure the OTLP endpoint is correct for your region

Check that the secret is mounted in the collector pod:

````bash
kubectl describe pod <collector-pod> -n newrelic | grep -A5 "Environment"
```


````

**Logs not being collected in Kubernetes**

Resolution

Verify you're using `mode: daemonset` (deployment mode cannot access node logs)

Check volume mounts are correctly configured:

````bash
kubectl describe pod <collector-pod> -n newrelic | grep -A10 "Mounts"
```


````

Verify the filelog receiver path matches your Elasticsearch pod logs:

````bash
kubectl exec -n newrelic <collector-pod> -- ls /var/log/pods/*/elasticsearch*/*.log
```


````

Ensure the collector has read permissions on host log directories

**Metrics missing k8s.cluster.name attribute**

Resolution

Verify `K8S_CLUSTER_NAME` environment variable is set in values.yaml

Check the `resource/cluster` processor is in the metrics pipeline

Query to verify:

````sql
FROM Metric SELECT * WHERE metricName LIKE 'elasticsearch.%' LIMIT 1
```

Check if <InlineCode>k8s.cluster.name</InlineCode> attribute is present


````

## APM correlation and distributed tracing [#correlation-troubleshooting]

These issues apply when you've set up [APM correlation with distributed tracing](https://docs.newrelic.com/docs/opentelemetry/integrations/elasticsearch/distributed-tracing).

**No Elasticsearch spans appear in New Relic**

How to check

````sql
FROM Span SELECT count(*) WHERE es.cluster.name = '<elasticsearch-cluster-name>' SINCE 30 minutes ago
```
<p><strong>Resolution</strong></p>

- Native OTLP trace export requires <strong>Elasticsearch 9.4 or later</strong>. Confirm your version with <InlineCode>curl http://localhost:9200</InlineCode>.
- Verify all three settings are present in <InlineCode>elasticsearch.yml</InlineCode>: <InlineCode>telemetry.tracing.enabled: true</InlineCode>, <InlineCode>telemetry.export.endpoint</InlineCode>, and <InlineCode>telemetry.tracing.sample_rate</InlineCode>.
- Confirm the JVM system property <InlineCode>-Dtelemetry.otel.traces.enabled=true</InlineCode> is set (in <InlineCode>jvm.options</InlineCode> or <InlineCode>ES_JAVA_OPTS</InlineCode>), then restart Elasticsearch.
- The default <InlineCode>telemetry.tracing.sample_rate</InlineCode> is <InlineCode>0.001</InlineCode> (0.1%). Raise it while validating so spans appear quickly.

````

**Elasticsearch is exporting spans but they never reach New Relic**

Resolution

-   Confirm the collector has an `otlp` receiver with the gRPC protocol enabled on `0.0.0.0:4317`, and that the endpoint is reachable from the Elasticsearch nodes.
-   Confirm a `traces` pipeline exists and includes the `otlp` receiver and the `otlphttp` exporter.
-   Check the collector logs for OTLP receiver or export errors.

**The cluster shows a relationship to itself (calls itself)**

Cause

A self-loop appears when Elasticsearch spans reach New Relic that can't be attributed to a calling application. There are two common sources:

-   Parentless (root) Elasticsearch spans — spans with no parent application span, such as Kubernetes health probes or the Elasticsearch metrics receiver's own scrape calls (`_nodes/stats`, `_cluster/health`, and similar). Because they aren't part of an application's trace, New Relic has no calling service and draws the relationship on the cluster itself.
-   The node's own address — Elasticsearch server spans carry `http.request.headers.host` (and `server.address`), which New Relic resolves back to the cluster.

    Resolution

    Add both processors to the `traces` pipeline, then restart the collector. `filter/drop_rootless_es` drops the parentless Elasticsearch spans (application-driven spans always have a parent, so they're kept), and `transform/strip_es_host` removes the address attributes:

    ```yaml
    processors:
      filter/drop_rootless_es:
        error_mode: ignore
        traces:
          span:
            - 'instrumentation_scope.name == "elasticsearch" and IsRootSpan()'
      transform/strip_es_host:
        error_mode: ignore
        trace_statements:
          - context: span
            statements:
              - delete_key(attributes, "http.request.headers.host") where instrumentation_scope.name == "elasticsearch"
              - delete_key(attributes, "server.address") where instrumentation_scope.name == "elasticsearch"
    # traces pipeline: processors: [filter/drop_rootless_es, transform/strip_es_host, batch]
    ```

    Existing self-loops clear on their own once the corrected spans arrive and the previous relationship expires (this can take up to about 75 minutes).

**Elasticsearch spans arrive, but applications aren't linked to the cluster**

Resolution

-   Make sure your applications are instrumented and propagate the W3C `traceparent` header on their Elasticsearch calls. Most modern Elasticsearch clients do this automatically when the application is instrumented with OpenTelemetry.
-   Open a distributed trace that includes an Elasticsearch call and confirm the application spans and Elasticsearch spans share the same trace.
-   Give the relationship a few minutes to build. New Relic re-evaluates entity relationships periodically.

**Traces and metrics resolve to different cluster entities**

Resolution

-   The traces path keys on `es.cluster.name` (stamped by Elasticsearch on its spans) and the metrics path on `elasticsearch.cluster.name`. The `elasticsearchreceiver` reports `elasticsearch.cluster.name` automatically from the value Elasticsearch returns, so both derive from the same `cluster.name` and resolve to one entity — no extra collector configuration needed.
-   Don't force the metrics cluster name to a fixed value. If your collector config sets it with a `resource` processor (for example a `resource/cluster_name_override` that hardcodes the name), remove that override — otherwise metrics and traces resolve to two different entities and the correlated entity shows no metrics data.
-   Make sure your Elasticsearch `cluster.name` is unique within your New Relic account so it maps to a single, unambiguous entity.