elk安装启动错误集合

如何关闭es

查找进程

ps -ef | grep elastic

kill -9 2382（进程号）

重新启动

bin/elasticsearch & 后台启动


 

es启动错误集合：

1.  ailed to obtain node locks, tried [[/elk/es/data/mini-cluster]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?

解决办法  rm -rf  /elk/es/data/node  删除这个文件夹

2.  BindHttpException[Failed to bind to [9200]]; nested: BindException[Address already in use];

出现这种原因可能是错误关闭es，残留的9200端口还存在

#lsof -i:9200|more

kill -9 pid号

3. logstash could not be started because there is already another instance using the configured data directory.  If you wish to run multiple instances, you must change the "path.data" setting.  

原因 之前有进程在后台启动运行过，所有必须杀死这个进程

ps -ef | grep java

因为logstash的启动 依赖java来运行的，所以可以找到这里面有logstash的进程 然后 kill -9 pid号 进行结束进程

 

 

一： es安装错误

1.提示错误

问题一：警告提示
[2016-12-20T22:37:28,543][INFO ][o.e.b.BootstrapCheck     ] [elk-node1] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
[2016-12-20T22:37:28,552][ERROR][o.e.b.Bootstrap          ] [elk-node1] node validation exception
bootstrap checks failed
max number of threads [1024] for user [elasticsearch] is too low, increase to at least [2048]
[2016-12-20T22:37:28,560][INFO ][o.e.n.Node               ] [elk-node1] stopping ...
[2016-12-20T22:37:28,628][INFO ][o.e.n.Node               ] [elk-node1] stopped
[2016-12-20T22:37:28,629][INFO ][o.e.n.Node               ] [elk-node1] closing ...
[2016-12-20T22:37:28,677][INFO ][o.e.n.Node               ] [elk-node1] closed

报了一大串错误，其实只是一个警告。

解决：使用心得linux版本，就不会出现此类问题了。

问题二：ERROR: bootstrap checks failed
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
max number of threads [1024] for user [lishang] likely too low, increase to at least [2048]
解决：切换到root用户，编辑limits.conf 添加类似如下内容
vi /etc/security/limits.conf 

添加如下内容:

* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
 
问题三：max number of threads [1024] for user [lish] likely too low, increase to at least [2048]

解决：切换到root用户，进入limits.d目录下修改配置文件。
vi /etc/security/limits.d/90-nproc.conf 
修改如下内容：

* soft nproc 1024
#修改为
* soft nproc 2048

问题四：max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]

解决：切换到root用户修改配置sysctl.conf

vi /etc/sysctl.conf 
添加下面配置：
vm.max_map_count=655360
并执行命令：
sysctl -p
然后，重新启动elasticsearch，即可启动成功。

   问题四：启动报错

　　es5.5 无法启动bug
　　报错：
　　ERROR: bootstrap checks failed
　　system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

　　这是在因为Centos6不支持SecComp，而ES5.2.0默认bootstrap.system_call_filter为true进行检测，所以导致检测失败，失败后直接导致ES不能启动。

　　解决：
　　在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:
　　bootstrap.memory_lock: false
　　bootstrap.system_call_filter: false