Service tokens file changed updating – How to solve this Elasticsearch error

Opster Team

Aug-23, Version: 7.13-8.9

Briefly, this error occurs when the Elasticsearch service tokens file is modified while the service is running. This file contains security tokens used for authentication and authorization. If it’s changed, Elasticsearch may not be able to authenticate users or services correctly. To resolve this issue, you can restart the Elasticsearch service to ensure it loads the updated tokens file. Alternatively, you can revert the changes to the tokens file if the modifications were not intended. Always ensure to backup the tokens file before making any changes to avoid any potential issues.

This guide will help you check for common problems that cause the log ” service tokens file [{}] changed. updating … ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.

Log Context

Log “service tokens file [{}] changed. updating …” classname is
We extracted the following from Elasticsearch source code for those seeking an in-depth context :

    private void tryReload() {
        final Map previousTokenHashes = tokenHashes;
        tokenHashes = parseFileLenient(file; logger);
        if (false == Maps.deepEquals(tokenHashes; previousTokenHashes)) {
  "service tokens file [{}] changed. updating ..."; file.toAbsolutePath());

    // package private for testing


How helpful was this guide?

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?