CentOS7下搭建ES，踩到的坑

1、使用root用户启动失败

es 启动，不能使用root用户，须切换到普通用户。

异常点

Caused by: java.lang.RuntimeException: can not run elasticsearch as root

解决办法：新建一个普通用户elk

groupadd elk
useradd -g elk elk

2、使用elk普通用户，启动es时，访问权限不够

异常点

Exception in thread "main" java.nio.file.AccessDeniedException: /opt/elk/elasticsearch-6.8.6/config/jvm.options
	at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84)
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
	at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:214)
	at java.nio.file.Files.newByteChannel(Files.java:361)
	at java.nio.file.Files.newByteChannel(Files.java:407)
	at java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:384)
	at java.nio.file.Files.newInputStream(Files.java:152)
	at org.elasticsearch.tools.launchers.JvmOptionsParser.main(JvmOptionsParser.java:60)

大概意思就是不能访问opt/elk/elasticsearch-6.8.6/config/jvm.options文件

可以去查看一下该文件的操作权限

[root@localhost config]# ll
总用量 36
-rw-rw----. 1 root root   199 3月  29 18:37 elasticsearch.keystore
-rw-r-----. 1 root root  2848 3月  29 18:59 elasticsearch.yml
-rw-r-----. 1 root root  3740 12月 14 2019 jvm.options
-rw-r-----. 1 root root 13085 12月 14 2019 log4j2.properties
-rw-r-----. 1 root root   473 12月 14 2019 role_mapping.yml
-rw-r-----. 1 root root   197 12月 14 2019 roles.yml
-rw-r-----. 1 root root     0 12月 14 2019 users
-rw-r-----. 1 root root     0 12月 14 2019 users_roles

解决办法：给elk用户，赋予操作相关文件的权限，个人建议，直接赋予elk用户对整个es安装目录的操作权限

chown  -R elk:elk /opt/elk/elasticsearch-6.8.6
 

再次查看opt/elk/elasticsearch-6.8.6/config/jvm.options文件的操作权限

[root@localhost config]# ll
总用量 36
-rw-rw----. 1 elk elk   199 3月  29 18:37 elasticsearch.keystore
-rw-r-----. 1 elk elk  2848 3月  29 18:59 elasticsearch.yml
-rw-r-----. 1 elk elk  3740 12月 14 2019 jvm.options
-rw-r-----. 1 elk elk 13085 12月 14 2019 log4j2.properties
-rw-r-----. 1 elk elk   473 12月 14 2019 role_mapping.yml
-rw-r-----. 1 elk elk   197 12月 14 2019 roles.yml
-rw-r-----. 1 elk elk     0 12月 14 2019 users
-rw-r-----. 1 elk elk     0 12月 14 2019 users_roles

3、重新启动es,发现已经无法启动。出现以下日志信息

[elk@localhost elasticsearch-6.8.6]$ bin/elasticsearch
[2022-03-30T10:48:10,875][INFO ][o.e.e.NodeEnvironment    ] [Pr5FG5w] using [1] data paths, mounts [[/ (/dev/mapper/centos-root)]], net usable_space [14.9gb], net total_space [16.9gb], types [xfs]
[2022-03-30T10:48:10,877][INFO ][o.e.e.NodeEnvironment    ] [Pr5FG5w] heap size [990.7mb], compressed ordinary object pointers [true]
[2022-03-30T10:48:10,882][INFO ][o.e.n.Node               ] [Pr5FG5w] node name derived from node ID [Pr5FG5weSQWErChslvFosg]; set [node.name] to override
[2022-03-30T10:48:10,883][INFO ][o.e.n.Node               ] [Pr5FG5w] version[6.8.6], pid[1529], build[default/tar/3d9f765/2019-12-13T17:11:52.013738Z], OS[Linux/3.10.0-1160.el7.x86_64/amd64], JVM[Red Hat, Inc./OpenJDK 64-Bit Server VM/1.8.0_322/25.322-b06]
[2022-03-30T10:48:10,883][INFO ][o.e.n.Node               ] [Pr5FG5w] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=/tmp/elasticsearch-2296415821934427314, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -XX:+PrintGCDetails, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+PrintGCApplicationStoppedTime, -Xloggc:logs/gc.log, -XX:+UseGCLogFileRotation, -XX:NumberOfGCLogFiles=32, -XX:GCLogFileSize=64m, -Des.path.home=/opt/elk/elasticsearch-6.8.6, -Des.path.conf=/opt/elk/elasticsearch-6.8.6/config, -Des.distribution.flavor=default, -Des.distribution.type=tar]
[2022-03-30T10:48:14,250][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [aggs-matrix-stats]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [analysis-common]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [ingest-common]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [ingest-geoip]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [ingest-user-agent]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [lang-expression]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [lang-mustache]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [lang-painless]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [mapper-extras]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [parent-join]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [percolator]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [rank-eval]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [reindex]
[2022-03-30T10:48:14,251][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [repository-url]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [transport-netty4]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [tribe]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-ccr]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-core]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-deprecation]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-graph]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-ilm]
[2022-03-30T10:48:14,254][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-logstash]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-ml]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-monitoring]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-rollup]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-security]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-sql]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-upgrade]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] loaded module [x-pack-watcher]
[2022-03-30T10:48:14,255][INFO ][o.e.p.PluginsService     ] [Pr5FG5w] no plugins loaded
[2022-03-30T10:48:17,396][INFO ][o.e.x.s.a.s.FileRolesStore] [Pr5FG5w] parsed [0] roles from file [/opt/elk/elasticsearch-6.8.6/config/roles.yml]
[2022-03-30T10:48:17,862][INFO ][o.e.x.m.p.l.CppLogMessageHandler] [Pr5FG5w] [controller/1603] [Main.cc@109] controller (64 bit): Version 6.8.6 (Build 73ed602c10c48e) Copyright (c) 2019 Elasticsearch BV
[2022-03-30T10:48:18,376][DEBUG][o.e.a.ActionModule       ] [Pr5FG5w] Using REST wrapper from plugin org.elasticsearch.xpack.security.Security
[2022-03-30T10:48:18,575][INFO ][o.e.d.DiscoveryModule    ] [Pr5FG5w] using discovery type [zen] and host providers [settings]
[2022-03-30T10:48:19,195][INFO ][o.e.n.Node               ] [Pr5FG5w] initialized
[2022-03-30T10:48:19,195][INFO ][o.e.n.Node               ] [Pr5FG5w] starting ...
[2022-03-30T10:48:19,332][INFO ][o.e.t.TransportService   ] [Pr5FG5w] publish_address {192.168.20.138:9300}, bound_addresses {[::]:9300}
[2022-03-30T10:48:19,356][INFO ][o.e.b.BootstrapChecks    ] [Pr5FG5w] bound or publishing to a non-loopback address, enforcing bootstrap checks
ERROR: [2] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
[2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2022-03-30T10:48:19,386][INFO ][o.e.n.Node               ] [Pr5FG5w] stopping ...
[2022-03-30T10:48:19,432][INFO ][o.e.n.Node               ] [Pr5FG5w] stopped
[2022-03-30T10:48:19,432][INFO ][o.e.n.Node               ] [Pr5FG5w] closing ...
[2022-03-30T10:48:19,454][INFO ][o.e.n.Node               ] [Pr5FG5w] closed

日志很长，那就抓重点看

 两个异常点，逐个解决。

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]

解决办法：切换到root用户

vi /etc/security/limits.conf

 在文件最后加入如下信息

*               hard    nofile          65536
*               soft    nofile          65536

 [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决办法：在/etc/sysctl.conf文件最后添加一行vm.max_map_count=262144

vi /etc/sysctl.conf

可以执行/sbin/sysctl -p 立即生效（ps:单独解决该问题时，可以使用，不需要重启服务器）

 重新启动服务器后，切换到elk用户，再次启动es应该就没什么问题了。