elasticSearch5.4遭遇问题概略

1.root超级用户不能正常启动

由于elasticsearch2.0版本以后不能使用root来启动，所以需要创建一个普通用户来启动。

[root@bogon ~]# groupadd elasticsearch[root@bogon ~]# useradd elasticsearch -g elasticsearch[root@bogon ~]# chown -R elasticsearch.elasticsearch /usr/local/elk/elasticsearch-5.2.1  [root@bogon ~]# su - elasticsearch[elasticsearch@bogon ~]$ cd /usr/local/elk/elasticsearch-5.2.1/bin/[elasticsearch@bogon bin]$ ./elasticsearch
1
2
3
4
5
6
1
2
3
4
5
6

由普通用户来启动，则可以正常启动服务。

2.ERROR: bootstrap checks failed

max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]max number of threads [1024] for user [lishang] likely too low, increase to at least [2048]解决：切换到root用户，编辑limits.conf 添加类似如下内容vi /etc/security/limits.conf 添加如下内容:* soft nofile 65536* hard nofile 131072* soft nproc 2048* hard nproc 4096

3.max number of threads [1024] for user [lish] likely too low, increase to at least [2048]

解决：切换到root用户，进入limits.d目录下修改配置文件。vi /etc/security/limits.d/90-nproc.conf 修改如下内容：* soft nproc 1024#修改为* soft nproc 2048

4.max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]

解决：切换到root用户修改配置sysctl.confvi /etc/sysctl.conf 添加下面配置：vm.max_map_count=655360并执行命令：sysctl -p然后，重新启动elasticsearch，即可启动成功。

5.
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
解决方法：在es配置中加入下面命令即可
bootstrap.system_call_filter: false