Briefly, this error occurs when Elasticsearch fails to monitor changes in the operator users file, which is crucial for security configurations. This could be due to incorrect file path, insufficient permissions, or system resource limitations. To resolve this, ensure the file path is correct, the Elasticsearch process has read permissions for the file, and your system has enough resources to handle file watches. If the issue persists, consider disabling file watching by setting “xpack.security.authc.token.thread_pool.queue_size” to -1 in the Elasticsearch configuration.
This guide will help you check for common problems that cause the log ” Failed to start watching the operator users file [” + file.toAbsolutePath() + “] ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.
Log Context
Log “Failed to start watching the operator users file [” + file.toAbsolutePath() + “]” class name is FileOperatorUsersStore.java. We extracted the following from Elasticsearch source code for those seeking an in-depth context :
FileWatcher watcher = new FileWatcher(file.getParent(); true);
watcher.addListener(new FileOperatorUsersStore.FileListener());
try {
watcherService.add(watcher; ResourceWatcherService.Frequency.HIGH);
} catch (IOException e) {
throw new ElasticsearchException("Failed to start watching the operator users file [" + file.toAbsolutePath() + "]"; e);
}
} public boolean isOperatorUser(Authentication authentication) {
// Other than realm name; other criteria must always be an exact match for the user to be an operator.
