Foreword: start elasticsearch in the test environment today to report an error. The error information is as follows:

main ERROR Unable to locate appender "rolling_old" for logger config "root"

It was because it was started with root for the first time. After the startup failed, it reported an error when switching users to start, because the file in the log directory belongs to root

Solution:

In the elasticsearch configuration file, find the directory where the logs are stored, change the user and group you belong to. Start it again and it's OK!
chown elk.elk -R /var/log/elasticsearch/