ELK问题集锦

转载自：https://blog.csdn.net/qq_22211217/article/details/80740873

一、Exception in thread "main" SettingsException[Failed to load settings from [elasticsearch.yml]]; nested: ElasticsearchParseException[malformed, expected settings to start with 'object', instead was [VALUE_STRING]];

原因：elasticsearch.yml文件错误

解决：参数与参数值等号间需要空格

1. node.name ="node" ##错误
2. node.name = "node" ##正确

二、org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

详细错误：

1. OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads a
2. [2018-06-20T02:19:58,978][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
3. org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
4. at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.3.0.jar:6.3.0]
5. at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.3.0.jar:6.3.0]
6. at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]
7. at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.3.0.jar:6.3.0]
8. at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.3.0.jar:6.3.0]
9. at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.3.0.jar:6.3.0]
10. at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]
11. Caused by: java.lang.RuntimeException: can not run elasticsearch as root
12. at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:104) ~[elasticsearch-6.3.0.jar:6.3.0]
13. at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:171) ~[elasticsearch-6.3.0.jar:6.3.0]
14. at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.3.0.jar:6.3.0]
15. at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.3.0.jar:6.3.0]
16. ... 6 more

原因：处于对root用户的安全保护，需要使用其他用户组进行授权启动

解决：

step1:用户组进行授权启动

1. groupadd elsearch
2. useradd elsearch -g elsearch -p elasticsearch
3. chown -R elsearch:elsearch elasticsearch-6.3.0

1. 备注： 添加用户组 elsearch
2. 添加用户 elsearch 密码为 elasticsearch 到用户组 elsearch
3. 将elsearch安装目录授权给 用户组：用户 即 elsearch：elsearch

step2: 重新启动

1. su elsearch
2. /elasticsearch-6.3.0/bin/elasticsearch

1. 备注：切换 elsearch 用户
2. 重新启动

三、OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000085330000, 2060255232, 0) failed; error='Cannot a ...'(errno=12);

原因：jvm要分配最大内存超出系统内存

解决：

step1：适当调整指定jvm内存

vi /home/elasticsearch-6.3.0/config/jvm.options 

备注：编辑elasticsearch jvm配置文件 修改如下 esc+：wq保存退出

1. ## JVM configuration
3. ################################################################
4. ## IMPORTANT: JVM heap size
5. ################################################################
6. ##
7. ## You should always set the min and max JVM heap
8. ## size to the same value. For example, to set
9. ## the heap to 4 GB, set:
10. ##
11. ## -Xms4g
12. ## -Xmx4g
13. ##
14. ## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
15. ## for more information
16. ##
17. ################################################################
19. # Xms represents the initial size of total heap space
20. # Xmx represents the maximum size of total heap space
22. -Xms512m
23. -Xmx512m

备注：由于虚拟机内存制定1g，所以适当降低jvm内存指定

step2:重启

1. su elsearch
2. /elasticsearch-6.3.0/bin/elasticsearch

四、ERROR: [3] bootstrap checks failed

详细错误：

1. [2018-06-20T02:35:47,152][INFO ][o.e.b.BootstrapChecks ] [SUcoFrg] bound or publishing to a non-loopback address, enforcing bootstrap checks
2. ERROR: [3] bootstrap checks failed
3. [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
4. [2]: max number of threads [3802] for user [elsearch] is too low, increase to at least [4096]
5. [3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
6. [2018-06-20T02:35:47,170][INFO ][o.e.n.Node ] [SUcoFrg] stopping ...
7. [2018-06-20T02:35:47,316][INFO ][o.e.n.Node ] [SUcoFrg] stopped
8. [2018-06-20T02:35:47,316][INFO ][o.e.n.Node ] [SUcoFrg] closing ...
9. [2018-06-20T02:35:47,336][INFO ][o.e.n.Node ] [SUcoFrg] closed

原因：虚拟机限制用户的执行内存

解决：

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

[2]: max number of threads [3802] for user [elsearch] is too low, increase to at least [4096]

step1:修改安全限制配置文件

1. su root
2. vi /etc/security/limits.conf

备注：使用最高权限 修改安全配置 在文件末尾加入

1. # End of file
2. elsearch hard nofile 65536
3. elsearch soft nofile 65536
4. * soft nproc 4096
5. * hard nproc 4096

1. 备注： elsearch为用户名 可以是使用*进行通配
2. nofile 最大打开文件数目
3. nproc 最大打开线程数目

[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

step2:修改系统配置文件

vi /etc/sysctl.conf 

备注：行末加上vm.max_map_count = 655360 ，esc +：wq保存退出

1. # sysctl settings are defined through files in
2. # /usr/lib/sysctl.d/, /run/sysctl.d/, and /etc/sysctl.d/.
3. #
4. # Vendors settings live in /usr/lib/sysctl.d/.
5. # To override a whole file, create a new file with the same in
6. # /etc/sysctl.d/ and put new settings there. To override
7. # only specific settings, add a file with a lexically later
8. # name in /etc/sysctl.d/ and put new settings there.
9. #
10. # For more information, see sysctl.conf(5) and sysctl.d(5).
11. vm.max_map_count = 655360

备注：vm.max_map_count = 655360 值大于错误提示值

step3:重启

1. su elsearch
2. /elasticsearch-6.3.0/bin/elasticsearch

五、org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/elasticsearch-6.3.0/data/elasticsearch]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?

详细报错：

1. [2018-06-20T04:23:25,003][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
2. org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/elasticsearch-6.3.0/data/elasticsearch]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?
3. at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.3.0.jar:6.3.0]
4. at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.3.0.jar:6.3.0]
5. at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]
6. at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.3.0.jar:6.3.0]
7. at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.3.0.jar:6.3.0]
8. at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.3.0.jar:6.3.0]
9. at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]
10. Caused by: java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/elasticsearch-6.3.0/data/elasticsearch]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?
11. at org.elasticsearch.env.NodeEnvironment. <init>(NodeEnvironment.java:243) ~[elasticsearch-6.3.0.jar:6.3.0]
12. at org.elasticsearch.node.Node. <init>(Node.java:270) ~[elasticsearch-6.3.0.jar:6.3.0]
13. at org.elasticsearch.node.Node. <init>(Node.java:252) ~[elasticsearch-6.3.0.jar:6.3.0]
14. at org.elasticsearch.bootstrap.Bootstrap$5. <init>(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0]
15. at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0]
16. at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.3.0.jar:6.3.0]
17. at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.3.0.jar:6.3.0]
18. ... 6 more

原因：线程占用

解决：重新启动

step1:杀死elasticsearch线程

ps -ef | grep elastic

kill -9 2002

step2: 重启

1. su elsearch
2. /elasticsearch-6.3.0/bin/elasticsearch

六、验证

1、后台启动

 /home/elasticsearch-6.3.0/bin/elasticsearch -d

2、curl验证

curl http://zk01:9200

3、网站验证

kibana安装好之后在远程浏览器输入localhost:5601打不开

原因是：配置文件绑定的是本机，需要修改配置文件为"0.0.0.0"