ELK下常见启动错误_refused to execute inline script because it violat

6、修改之后再启动试一下，结果又提示：can not run elasticsearch as root，这是不能使用root用户操作，添加一个其他的用户再试试

[root@centos7.4-64 elasticsearch-6.2.2]# adduser elastic
[root@centos7.4-64 elasticsearch-6.2.2]# passwd elastic

7、继续启动elasticsearch，又提示：Exception in thread “main” java.nio.file.AccessDeniedException: /usr/local/elasticsearch-6.2.2/config/jvm.options，没有jvm文件的权限，改一下所属的用户

[root@centos7.4-64 elasticsearch-6.2.2]# chown elastic /usr/local/elasticsearch-6.2.2/ -R

kibana报错

8、尝试安装kibana，结果又出现下列错误：

[elastic@centos7.4-64 ~]$ /usr/local/elasticsearch-6.2.2/bin/elasticsearch
。。。。。。省略其他启动信息
ERROR: [3] bootstrap checks failed
[1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [3895] for user [elastic] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2018-03-08T19:29:32,233][INFO ][o.e.n.Node               ] [s3f1uD4] stopping ...
[2018-03-08T19:29:32,397][INFO ][o.e.n.Node               ] [s3f1uD4] stopped
[2018-03-08T19:29:32,397][INFO ][o.e.n.Node               ] [s3f1uD4] closing ...
[2018-03-08T19:29:32,412][INFO ][o.e.n.Node               ] [s3f1uD4] closed

解决办法：
可以看到这里出现了三个错误，提示的也很清楚了，登录到root用户，修改如下：
【1】修改/etc/security/limits.conf，修改到提示值即可

[root@centos7.4-64 ~]# vim /etc/security/limits.conf
* hard nofile 65536

【2】修改/etc/security/limits.d/90-nproc.conf 文件

[root@centos7.4-64 ~]# vim /etc/security/limits.conf 
修改或添加
* hard nproc 4096
切换用户，如果还是不行则修改：/etc/security/limits.d/20-nproc.conf，其他文章上写的都是修改90-nproc.conf
不过我这个安装之后没有这个文件，只有一个20-nproc.conf，我的修改这个就行，刚开始学不知道什么原因
[root@centos7.4-64 ~]# vim /etc/security/limits.d/20-nproc.conf 

将内容改为：
*          soft    nproc     4096

【3】修改/etc/sysctl.conf

[root@centos7.4-64 ~]# vim /etc/sysctl.conf 
添加配置：vm.max_map_count=262144，然后执行命令
[root@centos7.4-64 ~]# sysctl -p

9、ES启动报错

报错信息：could not fidn java; set JAVA_HOME or ensure java is in PATH

解决办法 ：制作软连接
ln -s /usr/local/jdk1.8.0_XXX/bin/java /usr/bin/java

10、system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

解决办法 ： 在 config/elasticsearc.yml 中添加

bootstrap.system_call_filter: false

http://www.cnblogs.com/sloveling/p/elasticsearch.html

11、kibana无法外网访问

设置server.host = “0.0.0.0”
2:kibana7.x首次无法启动

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'nonce-SK5LdJc4MkeDocgq'". Either the 'unsafe-inline' keyword, a hash ('sha256-SHHSeLc0bp6xt4BoVVyUy+3IbVqp3ujLaR+s+kSP5UI='), or a nonce ('nonce-...') is required to enable inline execution.

设置logging.verbose: true
重启后文件解决

12、elasticsearch7.x启动报错

修改了network.host为0.0.0.0怎么都启动不起来，到/var/log/elasticsearch/查看错误日志如下

the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

解决步骤如下：（以ubuntu16.04为例）

vi /etc/security/limits.conf
添加：
* soft nofile 65534
* hard nofile 65534
root soft nofile 65534
root hard nofile 65534
重启电脑
vi  /etc/sysctl.conf
vm.max_map_count=262144
保存退出，sysctl  -p  
修改elasticsearch.yml
cluster.initial\_master\_nodes: ["node-1"]
 curl -H "Content-Type: application/json" -XPUT localhost:9200/_settings -d '{ "index" : { "refresh\_interval" : -1, "number\_of\_replicas" : 0 } }'

13、删除filebeat对文件的记录

/var/lib/filebeat/registry

删除这个里面的东西重启即可

相关讨论：https://discuss.elastic.co/t/problems-with-access-to-elasticsearch-form-outside-machine/172450

14、ogstash进程杀不掉

initctl stop logstash

15、安装x-pack出错

Exception in thread "main" java.nio.file.FileSystemException: /elasticsearch-6.1.2/config/x-pack: Operation not permitted
    at sun.nio.fs.UnixException.translateToIOException(UnixException.java:91)
    at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
    at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
    at sun.nio.fs.UnixFileAttributeViews$Posix.setOwners(UnixFileAttributeViews.java:252)
    at sun.nio.fs.UnixFileAttributeViews$Posix.setOwner(UnixFileAttributeViews.java:274)
    at org.elasticsearch.plugins.InstallPluginCommand.setOwnerGroup(InstallPluginCommand.java:725)
    at org.elasticsearch.plugins.InstallPluginCommand.installConfig(InstallPluginCommand.java:698)
    at org.elasticsearch.plugins.InstallPluginCommand.install(InstallPluginCommand.java:615)
    at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:215)
    at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:204)
    at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
    at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:75)
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124)
    at org.elasticsearch.cli.Command.main(Command.java:90)
    at org.elasticsearch.plugins.PluginCli.main(PluginCli.java:48)

解决办法：切换到root安装,可以成功安装上,安装上注意，需要重新对目录chmod，我是直接给的777，然后可以直接启动es。

16、java client连接带x-pack的elasticsearch6报错的问题（在ElasticSearch中安装X-pack后，通过TransportClient进行访问时，需要实例化PreBuiltXPackTransportClient，因此需要加入相应的jar包文件来增加此类。）

Exception in thread "main" java.lang.IllegalArgumentException: unknown setting [xpack.security.user] please check that any required plugins are installed, or check the breaking changes documentation for removed settings
at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:312)
at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:276)
at org.elasticsearch.common.settings.SettingsModule.<init>(SettingsModule.java:135)
at org.elasticsearch.client.transport.TransportClient.buildTemplate(TransportClient.java:140)
at org.elasticsearch.client.transport.TransportClient.<init>(TransportClient.java:262)
at org.elasticsearch.transport.client.PreBuiltTransportClient.<init>(PreBuiltTransportClient.java:128)
at org.elasticsearch.transport.client.PreBuiltTransportClient.<init>(PreBuiltTransportClient.java:114)
at org.elasticsearch.transport.client.PreBuiltTransportClient.<init>(PreBuiltTransportClient.java:104)

解决办法：

<repositories>
<repository>
<id>elasticsearch-releases</id>
<url>https://artifacts.elastic.co/maven</url>
<releases>
<enabled>true</enabled>
</releases>
<snapshots>
<enabled>false</enabled>
</snapshots>
</repository>
</repositories>
----------
<dependency>
<groupId>org.elasticsearch.client</groupId>
<artifactId>x-pack-transport</artifactId>
<version>5.2.2</version>
</dependency>

然后JAVA代码为：
TransportClient client = new PreBuiltXPackTransportClient(settings)

17、修改max_result_window出错

新版本的es不支持通过配置配置文件修改max_result_window（默认是10000），，不然会直接报错node settings must not contain any index level settings
需要通过api去修改，网上很多都没有给全命令
curl -XPUT “http://127.0.0.1:9200/dbver/_settings” -d ‘{“index”:{“max_result_window”:100000000}}’
上面这种会直接报错，{
“error”: “Content-Type header [application/x-www-form-urlencoded] is not supported”,
“status”: 406
}
需要加上-H指定类型
curl -XPUT “http://127.0.0.1:9200/dbver/_settings” -H ‘Content-Type: application/json’ -d ‘{“index”:{“max_result_window”:1000000}}’
这个就可以修改成功了，其中dbver替换成你需要的索引名称。

18、el6无法运行elasticsearch6版本

CentoOS 6 does not (as far as I can research) support SecComp, but ES tries to use it anyway, and fails to start 。

设置配置文件：bootstrap.system\_call\_filter: false

http://ciika.com/page/18/

19、es服务用root启动报错

报错信息 :

2020-04-26 19:14:45,653 main ERROR Null object returned for RollingFile in Appenders.
2020-04-26 19:14:45,654 main ERROR Unable to locate appender "rolling" for logger config "root"

报错原因 ：es配置文件下，要用普通用户启动es。不能使用root启动es
解决办法：

创建用户并授权
adduser elasticsearch
passwd elasticsearch
groupadd elasticsearch      #添加elasticsearch组

sudo chown -R elasticsearch:elasticsearch /usr/local/elasticsearch-6.2.3

20、

21、

22、

23、

24、

参考链接 ：
elasticsearch 常用命令 ： https://www.cnblogs.com/spicy/p/11893406.html

Elasticsearch5.0 安装问题集锦 ： https://blog.csdn.net/qq_34834325/article/details/78831247?depth_1-utm_source=distribute.pc_relevant.none-task&utm_source=distribute.pc_relevant.none-task

ELK常见问题 ： http://ciika.com/page/4/