elasticsearch/docs/reference/setup/install/etc-elasticsearch.asciidoc

The `/etc/elasticsearch` directory contains the default runtime configuration
for {es}. The ownership of this directory and all contained files are set to
`root:elasticsearch` on package installations.

The `setgid` flag applies group permissions on the `/etc/elasticsearch`
directory to ensure that {es} can read any contained files and subdirectories.
All files and subdirectories inherit the `root:elasticsearch` ownership.
Running commands from this directory or any subdirectories, such as the
<<secure-settings,elasticsearch-keystore tool>>, requires `root:elasticsearch`
permissions.

Elasticsearch loads its configuration from the
`/etc/elasticsearch/elasticsearch.yml` file by default. The format of this
config file is explained in <<settings>>.