elasticsearch启动失败记录

 1、使用root用户启动失败：

OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
[2019-12-11T15:45:07,664][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [localhost.localdomain] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.5.0.jar:7.5.0]
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.5.0.jar:7.5.0]
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.5.0.jar:7.5.0]
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.5.0.jar:7.5.0]
	at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.5.0.jar:7.5.0]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) ~[elasticsearch-7.5.0.jar:7.5.0]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.5.0.jar:7.5.0]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-7.5.0.jar:7.5.0]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-7.5.0.jar:7.5.0]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.5.0.jar:7.5.0]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.5.0.jar:7.5.0]
	... 6 more

解决：创建一个独立的用户，比如elk来启动elasticsearch，不用root用户启动

 

2、启动异常

ERROR: [5] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
[2]: max number of threads [1024] for user [es] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]:  failed to install; check the logs and fix your configuration or disable system call filters at your own risk
[5]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
[2019-04-09T09:51:29,228][INFO ][o.e.n.Node               ] [localhost.localdomain] stopping ...
[2019-04-09T09:51:29,264][INFO ][o.e.n.Node               ] [localhost.localdomain] stopped
[2019-04-09T09:51:29,265][INFO ][o.e.n.Node               ] [localhost.localdomain] closing ...
[2019-04-09T09:51:29,320][INFO ][o.e.n.Node               ] [localhost.localdomain] closed
[2019-04-09T09:51:29,323][INFO ][o.e.x.m.p.NativeController] [localhost.localdomain] Native controller process has stopped - no new native processes can be started

需要切回root用户修改

问题 [1]

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]

#解决方案：
vi /etc/security/limits.conf
#在文件末尾增加以下两行
* soft nofile 65536
* hard nofile 65536

问题[2] 

[2]: max number of threads [1024] for user [es] is too low, increase to at least [4096]

#解决方案[1]：
vi /etc/security/limits.d/90-nproc.conf
修改
 *   soft    nproc     1024
为
 *   soft    nproc     4096

#解决方案[2]：
vi /etc/security/limits.conf
#在文件末尾增加以下两行：
*  soft nproc  4096
*  hard nproc  4096

 问题[3]

[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

#解决方案：
vi /etc/sysctl.conf
#在文件末尾添加以下一行
vm.max_map_count=655360
#保存后执行
sysctl -p

问题[4] 

[4]:  failed to install; check the logs and fix your configuration or disable system call filters at your own risk

#解决方案：
在 elasticsearch.yml中添加配置项：bootstrap.system_call_filter为false：
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

 问题[5]

[5]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

#至少设置discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes中的一个

#解决方案：
修改elasticsearch.yml 
取消注释保留一个节点
cluster.initial_master_nodes: ["node-1"]
这个的话，这里的node-1是上面一个默认的记得打开就可以了