在搭建ELK日志分析系统中的常见问题和解决方案

1、Caused by: java.lang.RuntimeException: can not run elasticsearch as root

  该问题是因为启动elasticsearch 时,使用了root用户,所以只需要切换成elkb用户即可。详情请参考《如何快速搭建一个简易的ELK日志分析系统》。

错误信息如下:

[root@node08 elasticsearch-6.3.1]# ./bin/elasticsearch
[2020-05-13T17:40:36,170][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.3.1.jar:6.3.1]
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.3.1.jar:6.3.1]
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.3.1.jar:6.3.1]
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.3.1.jar:6.3.1]
	at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.3.1.jar:6.3.1]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.3.1.jar:6.3.1]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.3.1.jar:6.3.1]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:104) ~[elasticsearch-6.3.1.jar:6.3.1]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:171) ~[elasticsearch-6.3.1.jar:6.3.1]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.3.1.jar:6.3.1]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.3.1.jar:6.3.1]
	... 6 more
2、Exception in thread “main” java.nio.file.AccessDeniedException: /usr/local/soft/ELKB/elasticsearch-6.3.1/config/jvm.options

解决方案:因为elkb用户没有该文件夹的权限,所以执行如下命令即可:

chown -R elkb:elkb /usr/local/soft/ELKB/elasticsearch-6.3.1/
3、max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决方案:修改/etc/sysctl.conf文件,修改配置vm.max_map_count=262144

vim /etc/sysctl.conf #编辑配置
sysctl -p #使配置生效

在搭建ELK日志分析系统中的常见问题和解决方案_第1张图片

4、max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

解决方案:每个进程最大同时打开文件数太小,可通过下面2个命令查看当前数量:

ulimit -Hn
ulimit -Sn

在这里插入图片描述
修改/etc/security/limits.conf文件,增加配置,用户退出后重新登录生效
在这里插入图片描述

5、max number of threads [3818] for user [es] is too low, increase to at least [4096]

解决方案:同上面的一样,只需要在/etc/security/limits.conf文件中,添加如下配置即可:

*               soft    nproc           4096
*               hard    nproc           4096
6、在执行curl -XPOST 请求时,出现:{“error”:“Content-Type header [application/x-www-form-urlencoded] is not supported”,“status”:406}

比如,报错语句:

curl -XPOST 192.168.1.8:9200/test_index_1/test_type/5 -d '{'user_name':"xiaoming"}'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}

添加-H "Content-Type: application/json"请求头,如下所示:

curl -H "Content-Type: application/json" -XPOST 192.168.1.8:9200/test_index_1/test_type/5 -d '{'user_name':"xiaoming"}'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not supported","status":406}
7、{“type”:“mapper_parsing_exception”,“reason”:“No handler for type [string] declared on field [request]”}

解决方案:是因为ES的版本引起的,在5.x以上已经没有string类型。如果需要分词的话使用text,不需要分词使用keyword。

你可能感兴趣的:(异常处理,笔记)