elk报错解决

、elasticsearch启动失败如下：

[root@bogon home]# /home/elasticsearch-6.3./bin/elasticsearch
[--11T07::,][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:) ~[elasticsearch-6.3..jar:6.3.]
    at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:) ~[elasticsearch-6.3..jar:6.3.]
    at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:) ~[elasticsearch-6.3..jar:6.3.]
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:) ~[elasticsearch-cli-6.3..jar:6.3.]
    at org.elasticsearch.cli.Command.main(Command.java:) ~[elasticsearch-cli-6.3..jar:6.3.]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:) ~[elasticsearch-6.3..jar:6.3.]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:) ~[elasticsearch-6.3..jar:6.3.]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
    at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:) ~[elasticsearch-6.3..jar:6.3.]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:) ~[elasticsearch-6.3..jar:6.3.]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:) ~[elasticsearch-6.3..jar:6.3.]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:) ~[elasticsearch-6.3..jar:6.3.]
    ...  more

原因：出于对root用户的安全保护，需要使用其他用户组进行授权启动

解决：

groupadd elsearch
useradd elsearch -g elsearch -p elasticsearch
chown -R elsearch:elsearch  elasticsearch-6.3.

说明： 添加用户组 elsearch  

       添加用户 elsearch 密码为 elasticsearch 到用户组 elsearch

       将elsearch安装目录授权给 用户组：用户  即 elsearch：elsearch

重启elasticsearch

su elsearch

/home/elasticsearch-6.3./bin/elasticsearch

、elasticsearch启动报错如下：

ERROR: [] bootstrap checks failed
[]: max file descriptors [] for elasticsearch process is too low, increase to at least []
[]: max virtual memory areas vm.max_map_count [] is too low, increase to at least []
[--11T07::,][INFO ][o.e.n.Node               ] [lKlZCZf] stopping ...
[--11T07::,][INFO ][o.e.n.Node               ] [lKlZCZf] stopped
[--11T07::,][INFO ][o.e.n.Node               ] [lKlZCZf] closing ...
[--11T07::,][INFO ][o.e.n.Node               ] [lKlZCZf] closed

[]: max file descriptors [] for elasticsearch process is too low, increase to at least []

原因：虚拟机限制用户的执行内存

解决：

修改安全限制配置文件

说明：使用最高权限 修改安全配置 在文件末尾加入

su root

cat> /etc/security/limits.conf<<EOF

# End of file
elsearch       hard        nofile
elsearch       soft        nofile
*              soft       nproc
*              hard       nproc
EOF

说明： 

elsearch为用户名 可以是使用*进行通配  

nofile 最大打开文件数目

nproc 最大打开线程数目

[]: max virtual memory areas vm.max_map_count [] is too low, increase to at least []

解决：修改系统配置文件

vi /etc/sysctl.conf 

行末加上vm.max_map_count = 

# sysctl settings are defined through files in
# /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
#
# Vendors settings live in /usr/lib/sysctl.d/.
# To override a whole file, create a new file with the same in
# /etc/sysctl.d/ and put new settings there. To override
# only specific settings, add a file with a lexically later
# name in /etc/sysctl.d/ and put new settings there.
#
# For more information, see sysctl.conf() and sysctl.d().
vm.max_map_count = 

说明：vm.max_map_count =  值大于错误提示值

sed -i '$a\vm.max_map_count = 655360' /etc/sysctl.conf

重启linux系统，否则不生效

reboot

重启elasticsearch

su elsearch

/home/elasticsearch-6.3./bin/elasticsearch

、elasticsearch启动报错如下

org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException:
failed to obtain node locks, tried [[/home/elasticsearch-6.3./data/elasticsearch]] with
lock id []; maybe these locations are not writable or multiple nodes were started
without increasing [node.max_local_storage_nodes] (was [])?

原因：线程占用

解决：

杀死elasticsearch线程

ps -ef | grep elastic

kill - 

重启elasticsearch

su elsearch

/home/elasticsearch-6.3./bin/elasticsearch