can not run elasticsearch as root
[o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
解决方案：
因为安全问题 elasticsearch 不让用 root 用户直接运行，建议创建一个单独的用户用来运行
elasticsearch。我们可以创建 elsearch 用户组及 elsearch 用户，然后用这个用户来启动 elasticsearch。
groupadd elsearch
useradd elsearch -g elsearch -p elasticsearch
access denied
main ERROR Could not register mbeans java.security.AccessControlException: access denied ("javax.management.MBeanTrustPermission" "register")
解决方案：
root 用户下，改变 elasticsearch-5.1.1 文件夹所有者给 elasticsearch 启动用户：
sudo chown -R elsearch:elsearch elasticsearch-5.1.1
There is insufficient memory for the Java Runtime Environment to continue
Cannot allocate memory
Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000085330000, 2060255232, 0) failed; error='Cannot allocate memory' (errno=12)
There is insufficient memory for the Java Runtime Environment to continue.
解决方案：
修改 config/jvm.options，2g改成1g，也可以更小
-Xmx2g => -Xmx1g
unable to install syscall filter
unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
at org.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.java:349) ~[elasticsearch-5.0.0.jar:5.0.0]
at org.elasticsearch.bootstrap.Seccomp.init(Seccomp.java:630) ~[elasticsearch-5.0.0.jar:5.0.0]
报了一大串错误，其实只是一个警告。
解决方案：
使用最新 Linux 版本，就不会出现此类问题了，可用忽略。
max number of threads [1024] for user [lish] likely too low, increase to at least [2048]
解决方案：
root 用户下，进入 limits.d 目录下修改配置文件：
vim /etc/security/limits.d/90-nproc.conf
修改 soft nproc：
soft nproc 2048
max file descriptors for elasticsearch process likely too low
ERROR: bootstrap checks failed
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
max number of threads [1024] for user [lishang] likely too low, increase to at least [2048]
解决方案：
root 用户下，编辑 limits.conf：
vim /etc/security/limits.conf
添加如下内容:
* soft nofile 65536
* hard nofile 65536
* soft nproc 2048
* hard nproc 4096
system call filters failed to install
ERROR: bootstrap checks failed
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
解决方案：
修改 elasticsearch 配置文件：
vim config/elasticsearch.yml
增加配置：
bootstrap.system_call_filter: false
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
解决方案：
root 用户下，修改配置 sysctl.conf
vim /etc/sysctl.conf
添加下面配置：
vm.max_map_count=655360
执行命令：
sysctl -p
重新启动 elasticsearch