Configuring the Elasticsearch Windows service

Sometimes, after a major Windows server migration (for example 2016 to 2019 to 2022) or a Windows update, the Elasticsearch 8 Windows service registry entries become corrupted. The usual symptom is an instant startup failure, often Error 1067: The process terminated unexpectedly, with three start attempts logged in the Event Viewer.

Resolution

With Informer offline, first confirm the Elasticsearch index data is not corrupted.

Open an elevated PowerShell and navigate to the Informer install root, then into the Elasticsearch bin directory, for example \elasticsearch\elasticsearch-8.2.2\bin. Start Elasticsearch in the foreground by calling elasticsearch.bat with no parameters:
```
.\elasticsearch.bat
```
Memory during this test
Started this way, Elasticsearch pulls 50% of server RAM. This is normal and only for testing.
After the output settles, find current.health= in the startup log. The health starts Red and then moves to Green, Yellow, or stays Red:
- Green: only achievable with an Elasticsearch cluster or a blank Elasticsearch with no data.
- Yellow: acceptable, and the ideal result in most cases.
- Red: if Red persists, contact Support at i5support@entrinsik.com, send the PowerShell output, and take no further action.
If you see Green or Yellow, stop Elasticsearch with Ctrl + C and choose y at the prompt. Keep this PowerShell window open.
Open an elevated Command Prompt and delete the corrupted service:
```
sc delete elasticsearch8
```
Back in the PowerShell window (still in the bin directory), reinstall the service:
```
.\elasticsearch-service.bat install elasticsearch8
```

The Elasticsearch Windows service is restored. Before starting it, check its memory allocation (see Elasticsearch 7 & 8 on Windows memory configuration). Then start Elasticsearch and Informer.

Resolution​

Resolution