ELKB5.3 遇到的問題介紹

問題1：

[elk@storm2 bin]$ OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000094cc0000, 1798569984, 0) failed; error='Cannot allocate memory' (errno=12)

#

# There is insufficient memory for the Java Runtime Environment to continue.

# Native memory allocation (mmap) failed to map 1798569984 bytes for committing reserved memory.

# An error report file with more information is saved as:

# /usr/local/elasticsearch-5.3.0/bin/hs_err_pid16731.log

解決方法：

You have configured a virtual machine with 1 GB of RAM, but elastic is trying to start with 2 GB of RAM (default for Elasticsearch version 5.X)

5.X版本 Elasticsearch安裝需要2G以上記憶體

問題2：

max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

echo "* soft nofile 65536" >> /etc/security/limits.conf

echo "* hard nofile 131072" >> /etc/security/limits.conf

echo "* soft nproc 2048" >> /etc/security/limits.conf

echo "* hard nproc 4096" >> /etc/security/limits.conf

sysctl -w vm.max_map_count=262144

filebeat中moduel的使用方法

filebeat.yml配置如下：

1

2

3

4

5

6

7

8

9

10

11

12

<code>filebeat.modules:</code>

<code>#-------------------------------- Nginx Module -------------------------------</code>

<code>- module: nginx</code>

<code>  </code><code>#Access logs</code>

<code>  </code><code>access:</code>

<code>    </code><code>enabled: </code><code>true</code>

<code>  </code><code>error:</code>

<code>#-------------------------- Elasticsearch output -------------------------------</code>

<code>output.elasticsearch:</code>

<code>  </code><code>enabled: </code><code>true</code>

<code>  </code><code>hosts: [</code><code>"192.168.2.209:9200"</code><code>]</code>

elasticsearch安裝如下插件  

<code>bin</code><code>/elasticsearch-plugin</code> <code>install</code> <code>ingest-user-agent</code>

<code>bin</code><code>/elasticsearch-plugin</code> <code>install</code> <code>ingest-geoip</code>

備注：使用子產品的話必須使用 Elasticsearch output，否者會報錯

<code>Exiting: Filebeat modules configured but the Elasticsearch output is not configured</code><code>/enabled</code>

本文轉自 irow10 51CTO部落格，原文連結：http://blog.51cto.com/irow10/1917115，如需轉載請自行聯系原作者