elk报错记录

qweewq123qwe

报错信息一：can not run elasticsearch as root
　　[root@localhost bin]# ./elasticsearch
[2018-06-22T18:06:16,313][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:125) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.2.4.jar:6.2.4]
at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) ~[elasticsearch-6.2.4.jar:6.2.4]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.2.4.jar:6.2.4]
... 6 more

解决办法：

主要看报错第二行：can not run elasticsearch as root ：意思是不能用root用户运行elasticesearch
新建用户elasearch 专用于操作elk
groupadd elasearch
useradd elasearch -g elasearch
chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/
切换到elasticsearch用户启动es。
报错问题二： increase to at least [65536]
　　ERROR: [3] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
　　上边的描述:
[2018-07-05T19:24:50,764][WARN ][o.e.b.JNANatives         ] Unable to lock JVM Memory: error=12, reason=Cannot allocate memory
[2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives         ] This can result in part of the JVM being swapped out.
[2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives         ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
[2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives         ] These can be adjusted by modifying /etc/security/limits.conf, for example:
allow user 'elasticsearch' mlockall
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited

解决办法：

echo '* soft nofile 65536' >> /etc/security/limits.conf
echo '* hard nofile 65536' >> /etc/security/limits.conf
报错信息三：memory is not locked
　　[2]: memory locking requested for elasticsearch process but memory is not locked

解决办法：报错的信息也有显示这个解决办法

elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
报错信息四：AccessDeniedException
　　Likely root cause: java.nio.file.AccessDeniedException: /usr/local/elasticsearch-6.2.4/config/elasticsearch.keystore
　　原因：当前用户没有接入权限

解决办法：
　　chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/

报错信息五： vm.max_map_count [65530] is too low
　　[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决办法：

echo 'vm.max_map_count=262144' >> /etc/sysctl.conf
sysctl -p
报错信息六：
　　[ERROR][i.n.u.ResourceLeakDetector] LEAK: ByteBuf.release() was not called before it's garbage-collected. Enable advanced leak reporting to find out where the leak occurred. To enable advanced leak reporting, specify the JVM option '-Dio.netty.leakDetection.level=advanced' or call ResourceLeakDetector.setLevel() See http://netty.io/wiki/reference-counted-objects.html for more information.

解决办法：

修改jvm配置，添加以下配置：
-Dio.netty.leakDetection.level=advanced