ELK安装经常遇到的问题

ES可能遇到的问题
java版本问题，使用Elasticsearch5.0 必须安装jdk1.8
[elsearch@vm-mysteel-dc-search01 bin]$ java -version
java version "1.8.0_112"
Java(TM) SE Runtime Environment (build 1.8.0_112-b15)
Java HotSpot(TM) 64-Bit Server VM (build 25.112-b15, mixed mode)
[elsearch@vm-mysteel-dc-search01 bin]$ 

运行es,会提示错误，类似一些version error的错误。JDK版本若不是8，可能会出现ES启动不起来的问题。linux 自带的opensdk7 也最好不要使用。 
Elasticsearch依赖Java 8，在你安装Elasticsearch之前，你可以通过以下命令来检查你的Java版本（如果有需要，安装或者升级）： java –version

2.不能使用root用户启动，can not run elasticsearch as root

切换到非root用户 
因为安全问题elasticsearch 不让用root用户直接运行，所以要创建新用户

[2017-01-17T21:54:48,798][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.cli.SettingCommand.execute(SettingCommand. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.cli.Command.main(Command. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch. ~[elasticsearch-5.1.2.jar:5.1.2]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
        at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap. ~[elasticsearch-5.1.2.jar:5.1.2]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch. ~[elasticsearch-5.1.2.jar:5.1.2]
        ... 6 more

3.ES启动错误

[2017-01-12T15:55:55,433][INFO ][o.e.b.BootstrapCheck ] [SfD5sIh] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks 
ERROR: bootstrap checks failed 
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

● 临时提高vm.max_map_count的大小，此操作需要root权限： 
sudo sysctl -w vm.max_map_count=262144 
sysctl -a|grep vm.max_map_count 
● 永久修改vm.max_map_count： 
解决：切换到root用户修改配置sysctl.conf 
vi /etc/sysctl.conf 
添加下面配置： 
vm.max_map_count=655360 
并执行命令： 
sysctl -p 
然后，重新启动elasticsearch，即可启动成功。

4.ES启动报错

2017-01-12T16:12:22,404][INFO ][o.e.b.BootstrapCheck ] [SfD5sIh] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks 
ERROR: bootstrap checks failed 
initial heap size [536870912] not equal to maximum heap size [1073741824]; this can cause resize pauses and prevents mlockall from locking the entire heap

解决方法： 
vi config/jvm.options 
//-Xms 和 -Xmx需要配置的相等，不然无法启动成功。 
-Xms1024m 
-Xmx1024m