博客

ELK问题集锦

  • Post author:
  • Post category:其他


一、Exception in thread “main” SettingsException[Failed to load settings from [elasticsearch.yml]]; nested: ElasticsearchParseException[malformed, expected settings to start with ‘object’, instead was [VALUE_STRING]];

原因：elasticsearch.yml文件错误

解决：参数与参数值等号间需要空格


node.name

=“node” ##错误


node.name

= “node” ##正确

二、org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

详细错误：

OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads a

[2018-06-20T02:19:58,978][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]

org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.3.0.jar:6.3.0]

at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]

Caused by: java.lang.RuntimeException: can not run elasticsearch as root

at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:104) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:171) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.3.0.jar:6.3.0]

… 6 more

原因：处于对root用户的安全保护，需要使用其他用户组进行授权启动

解决：

step1:用户组进行授权启动

groupadd elsearch

useradd elsearch -g elsearch -p elasticsearch

chown -R elsearch:elsearch elasticsearch-6.3.0

备注： 添加用户组 elsearch

添加用户 elsearch 密码为 elasticsearch 到用户组 elsearch

将elsearch安装目录授权给 用户组：用户 即 elsearch：elsearch

step2: 重新启动

su elsearch

/elasticsearch-6.3.0/bin/elasticsearch

备注：切换 elsearch 用户

重新启动

三、OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000085330000, 2060255232, 0) failed; error=‘Cannot a …’(errno=12);

原因：jvm要分配最大内存超出系统内存

解决：

step1：适当调整指定jvm内存

vi /home/elasticsearch-6.3.0/config/jvm.options

备注：编辑elasticsearch jvm配置文件 修改如下 esc+：wq保存退出



JVM configuration

################################################################



IMPORTANT: JVM heap size

################################################################





You should always set the min and max JVM heap



size to the same value. For example, to set



the heap to 4 GB, set:





-Xms4g



-Xmx4g





See

https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html



for more information



################################################################



Xms represents the initial size of total heap space



Xmx represents the maximum size of total heap space

-Xms512m

-Xmx512m

备注：由于虚拟机内存制定1g，所以适当降低jvm内存指定

step2:重启

su elsearch

/elasticsearch-6.3.0/bin/elasticsearch

四、ERROR: [3] bootstrap checks failed

详细错误：

[2018-06-20T02:35:47,152][INFO ][o.e.b.BootstrapChecks ] [SUcoFrg] bound or publishing to a non-loopback address, enforcing bootstrap checks

ERROR: [3] bootstrap checks failed

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

[2]: max number of threads [3802] for user [elsearch] is too low, increase to at least [4096]

[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

[2018-06-20T02:35:47,170][INFO ][o.e.n.Node ] [SUcoFrg] stopping …

[2018-06-20T02:35:47,316][INFO ][o.e.n.Node ] [SUcoFrg] stopped

[2018-06-20T02:35:47,316][INFO ][o.e.n.Node ] [SUcoFrg] closing …

[2018-06-20T02:35:47,336][INFO ][o.e.n.Node ] [SUcoFrg] closed

原因：虚拟机限制用户的执行内存

解决：

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

[2]: max number of threads [3802] for user [elsearch] is too low, increase to at least [4096]

step1:修改安全限制配置文件

su root

vi /etc/security/limits.conf

备注：使用最高权限 修改安全配置 在文件末尾加入



End of file

elsearch hard nofile 65536

elsearch soft nofile 65536

  • soft nproc 4096
  • hard nproc 4096

    备注： elsearch为用户名 可以是使用*进行通配

    nofile 最大打开文件数目

    nproc 最大打开线程数目

[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

step2:修改系统配置文件

vi /etc/sysctl.conf

备注：行末加上vm.max_map_count = 655360 ，esc +：wq保存退出

备注：vm.max_map_count = 655360 值大于错误提示值

step3:重启

su elsearch

/elasticsearch-6.3.0/bin/elasticsearch

五、org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/elasticsearch-6.3.0/data/elasticsearch]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?

详细报错：

[2018-06-20T04:23:25,003][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]

org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/elasticsearch-6.3.0/data/elasticsearch]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?

at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:140) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.3.0.jar:6.3.0]

at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.3.0.jar:6.3.0]

Caused by: java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/elasticsearch-6.3.0/data/elasticsearch]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?

at org.elasticsearch.env.NodeEnvironment.(NodeEnvironment.java:243) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.node.Node.(Node.java:270) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.node.Node.(Node.java:252) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:326) ~[elasticsearch-6.3.0.jar:6.3.0]

at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.3.0.jar:6.3.0]

… 6 more

原因：线程占用

解决：重新启动

step1:杀死elasticsearch线程

ps -ef | grep elastic

kill -9 2002

step2: 重启

su elsearch

/elasticsearch-6.3.0/bin/elasticsearch

六、验证

1、后台启动

/home/elasticsearch-6.3.0/bin/elasticsearch -d

2、curl验证

curl

http://zk01:9200

3、网站验证

kibana安装好之后在远程浏览器输入localhost:5601打不开

原因是：配置文件绑定的是本机，需要修改配置文件为”0.0.0.0″