ELK下elasticsearch启动常见错误

1、问题出现环境，OS版本：CentOS-7-x86_64-Minimal-1708；ES版本：elasticsearch-6.2.2。

1、max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

解决办法2：https://blog.csdn.net/qq_32635069/article/details/89003055?depth_1-utm_source=distribute.pc_relevant.none-task&utm_source=distribute.pc_relevant.none-task
　　每个进程最大同时打开文件数太小，可通过下面2个命令查看当前数量

ulimit -Hn
ulimit -Sn

修改/etc/security/limits.conf文件，增加配置，用户退出后重新登录生效

*               soft    nofile          65536
*               hard    nofile          65536

2、max number of threads [3818] for user [es] is too low, increase to at least [4096]

问题同上，最大线程个数太低。修改配置文件/etc/security/limits.conf（和问题1是一个文件），增加配置

*               soft    nproc           4096
*               hard    nproc           4096

可通过命令查看

ulimit -Hu
ulimit -Su

修改后的文件：

3、max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

修改/etc/sysctl.conf文件，增加配置vm.max_map_count=262144

vi /etc/sysctl.conf
sysctl -p

执行命令sysctl -p生效

4、Exception in thread “main” java.nio.file.AccessDeniedException: /usr/local/elasticsearch/elasticsearch-6.2.2-1/config/jvm.options

elasticsearch用户没有该文件夹的权限，执行命令

chown -R es:es /usr/local/elasticsearch/

或者

原因 ： jdk必须是8以上，但是装的已经是8了为什么还不行。

原因：
因为elasticsearch文件夹所在路径是root路径下

解决：
mv /root/app/elasticsearch-5.4.0 /usr/app/elasticsearch-5.4.0/

5 、内存小

刚安装完成启动就出错了：error=‘Cannot allocate memory’

centos7.4-64 elasticsearch-6.2.2]# ./bin/elasticsearch -d
Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000c5330000, 986513408, 0) failed; error='Cannot allocate memory' (errno=12)

看来是我这1G的内存太小了啊，elasticsearch使用java的jvm默认是使用1G的内存的，这里我们修改一下内存，直接把内存改到200m

[[email protected] elasticsearch-6.2.2]# vim ./config/jvm.options

#修改内容
-Xms200m
-Xmx200m

6、修改之后再启动试一下，结果又提示：can not run elasticsearch as root，这是不能使用root用户操作，添加一个其他的用户再试试

[[email protected] elasticsearch-6.2.2]# adduser elastic
[[email protected] elasticsearch-6.2.2]# passwd elastic

7、继续启动elasticsearch，又提示：Exception in thread “main” java.nio.file.AccessDeniedException: /usr/local/elasticsearch-6.2.2/config/jvm.options，没有jvm文件的权限，改一下所属的用户

[[email protected] elasticsearch-6.2.2]# chown elastic /usr/local/elasticsearch-6.2.2/ -R

kibana报错

8、尝试安装kibana，结果又出现下列错误：

[[email protected] ~]$ /usr/local/elasticsearch-6.2.2/bin/elasticsearch
。。。。。。省略其他启动信息
ERROR: [3] bootstrap checks failed
[1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [3895] for user [elastic] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2018-03-08T19:29:32,233][INFO ][o.e.n.Node               ] [s3f1uD4] stopping ...
[2018-03-08T19:29:32,397][INFO ][o.e.n.Node               ] [s3f1uD4] stopped
[2018-03-08T19:29:32,397][INFO ][o.e.n.Node               ] [s3f1uD4] closing ...
[2018-03-08T19:29:32,412][INFO ][o.e.n.Node               ] [s3f1uD4] closed

解决办法：
可以看到这里出现了三个错误，提示的也很清楚了，登录到root用户，修改如下：
【1】修改/etc/security/limits.conf，修改到提示值即可

[[email protected] ~]# vim /etc/security/limits.conf
* hard nofile 65536

【2】修改/etc/security/limits.d/90-nproc.conf 文件

[[email protected] ~]# vim /etc/security/limits.conf 
修改或添加
* hard nproc 4096
切换用户，如果还是不行则修改：/etc/security/limits.d/20-nproc.conf，其他文章上写的都是修改90-nproc.conf
不过我这个安装之后没有这个文件，只有一个20-nproc.conf，我的修改这个就行，刚开始学不知道什么原因
[[email protected] ~]# vim /etc/security/limits.d/20-nproc.conf 

将内容改为：
*          soft    nproc     4096

【3】修改/etc/sysctl.conf

[[email protected] ~]# vim /etc/sysctl.conf 
添加配置：vm.max_map_count=262144，然后执行命令
[[email protected] ~]# sysctl -p

9、ES启动报错

报错信息：could not fidn java; set JAVA_HOME or ensure java is in PATH

解决办法 ：制作软连接
ln -s /usr/local/jdk1.8.0_XXX/bin/java /usr/bin/java

10、system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

解决办法 ： 在 config/elasticsearc.yml 中添加

bootstrap.system_call_filter: false

http://www.cnblogs.com/sloveling/p/elasticsearch.html

11、kibana无法外网访问

设置server.host = “0.0.0.0”
2:kibana7.x首次无法启动

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'nonce-SK5LdJc4MkeDocgq'". Either the 'unsafe-inline' keyword, a hash ('sha256-SHHSeLc0bp6xt4BoVVyUy+3IbVqp3ujLaR+s+kSP5UI='), or a nonce ('nonce-...') is required to enable inline execution.

设置logging.verbose: true
重启后文件解决

12、elasticsearch7.x启动报错

修改了network.host为0.0.0.0怎么都启动不起来，到/var/log/elasticsearch/查看错误日志如下

the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

解决步骤如下：（以ubuntu16.04为例）

vi /etc/security/limits.conf
添加：
* soft nofile 65534
* hard nofile 65534
root soft nofile 65534
root hard nofile 65534
重启电脑
vi  /etc/sysctl.conf
vm.max_map_count=262144
保存退出，sysctl  -p  
修改elasticsearch.yml
cluster.initial_master_nodes: ["node-1"]
 curl -H "Content-Type: application/json" -XPUT localhost:9200/_settings -d '{ "index" : { "refresh_interval" : -1, "number_of_replicas" : 0 } }'

13、删除filebeat对文件的记录

/var/lib/filebeat/registry

删除这个里面的东西重启即可

相关讨论：https://discuss.elastic.co/t/problems-with-access-to-elasticsearch-form-outside-machine/172450

14、ogstash进程杀不掉

initctl stop logstash

15、安装x-pack出错

Exception in thread "main" java.nio.file.FileSystemException: /elasticsearch-6.1.2/config/x-pack: Operation not permitted
    at sun.nio.fs.UnixException.translateToIOException(UnixException.java:91)
    at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
    at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
    at sun.nio.fs.UnixFileAttributeViews$Posix.setOwners(UnixFileAttributeViews.java:252)
    at sun.nio.fs.UnixFileAttributeViews$Posix.setOwner(UnixFileAttributeViews.java:274)
    at org.elasticsearch.plugins.InstallPluginCommand.setOwnerGroup(InstallPluginCommand.java:725)
    at org.elasticsearch.plugins.InstallPluginCommand.installConfig(InstallPluginCommand.java:698)
    at org.elasticsearch.plugins.InstallPluginCommand.install(InstallPluginCommand.java:615)
    at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:215)
    at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:204)
    at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
    at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:75)
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
    at org.elasticsearch.cli.Command.main(Command.java:90)
    at org.elasticsearch.plugins.PluginCli.main(PluginCli.java:48)

解决办法：切换到root安装,可以成功安装上,安装上注意，需要重新对目录chmod，我是直接给的777，然后可以直接启动es。

16、java client连接带x-pack的elasticsearch6报错的问题（在ElasticSearch中安装X-pack后，通过TransportClient进行访问时，需要实例化PreBuiltXPackTransportClient，因此需要加入相应的jar包文件来增加此类。）

Exception in thread "main" java.lang.IllegalArgumentException: unknown setting [xpack.security.user] please check that any required plugins are installed, or check the breaking changes documentation for removed settings
at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:312)
at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:276)
at org.elasticsearch.common.settings.SettingsModule.(SettingsModule.java:135)
at org.elasticsearch.client.transport.TransportClient.buildTemplate(TransportClient.java:140)
at org.elasticsearch.client.transport.TransportClient.(TransportClient.java:262)
at org.elasticsearch.transport.client.PreBuiltTransportClient.(PreBuiltTransportClient.java:128)
at org.elasticsearch.transport.client.PreBuiltTransportClient.(PreBuiltTransportClient.java:114)
at org.elasticsearch.transport.client.PreBuiltTransportClient.(PreBuiltTransportClient.java:104)

解决办法：

elasticsearch-releases
https://artifacts.elastic.co/maven

true


false



----------

org.elasticsearch.client
x-pack-transport
5.2.2

然后JAVA代码为：
TransportClient client = new PreBuiltXPackTransportClient(settings)

17、修改max_result_window出错

新版本的es不支持通过配置配置文件修改max_result_window（默认是10000），，不然会直接报错node settings must not contain any index level settings
需要通过api去修改，网上很多都没有给全命令
curl -XPUT “http://127.0.0.1:9200/dbver/_settings” -d ‘{“index”:{“max_result_window”:100000000}}’
上面这种会直接报错，{
“error”: “Content-Type header [application/x-www-form-urlencoded] is not supported”,
“status”: 406
}
需要加上-H指定类型
curl -XPUT “http://127.0.0.1:9200/dbver/_settings” -H ‘Content-Type: application/json’ -d ‘{“index”:{“max_result_window”:1000000}}’
这个就可以修改成功了，其中dbver替换成你需要的索引名称。

18、el6无法运行elasticsearch6版本

CentoOS 6 does not (as far as I can research) support SecComp, but ES tries to use it anyway, and fails to start 。

设置配置文件：bootstrap.system_call_filter: false

http://ciika.com/page/18/

19、es服务用root启动报错

报错信息 :

2020-04-26 19:14:45,653 main ERROR Null object returned for RollingFile in Appenders.
2020-04-26 19:14:45,654 main ERROR Unable to locate appender "rolling" for logger config "root"

报错原因 ：es配置文件下，要用普通用户启动es。不能使用root启动es
解决办法：

创建用户并授权
adduser elasticsearch
passwd elasticsearch
groupadd elasticsearch      #添加elasticsearch组

sudo chown -R elasticsearch:elasticsearch /usr/local/elasticsearch-6.2.3

20、

21、

22、

23、

24、

参考链接 ：
elasticsearch 常用命令 ： https://www.cnblogs.com/spicy/p/11893406.html

Elasticsearch5.0 安装问题集锦 ： https://blog.csdn.net/qq_34834325/article/details/78831247?depth_1-utm_source=distribute.pc_relevant.none-task&utm_source=distribute.pc_relevant.none-task

ELK常见问题 ： http://ciika.com/page/4/

elasticsearch不能以root用户运行：can not run elasticsearch as root : https://blog.csdn.net/changrj6/article/details/97765228
elasticsearch-6.2.2安装错误解决方案 ： https://blog.csdn.net/u010781176/article/details/79489151