ElasticSearch常见问题及解决方法

1、问题一：

org.elasticsearch.bootstrap.StartupException:BindTransportException[Failed to bind to [9300]]; nested: BindException[无法指定被请求的地址];

         atorg.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:127)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:114)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.cli.Command.main(Command.java:88)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84)~[elasticsearch-5.4.1.jar:5.4.1]

Caused by:org.elasticsearch.transport.BindTransportException: Failed to bind to [9300]

         atorg.elasticsearch.transport.TcpTransport.bindToPort(TcpTransport.java:769)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.transport.TcpTransport.bindServer(TcpTransport.java:734)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.transport.netty4.Netty4Transport.doStart(Netty4Transport.java:173)~[?:?]

         atorg.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:69)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.transport.TransportService.doStart(TransportService.java:196)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:69)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.node.Node.start(Node.java:686) ~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:277)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:359)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:123)~[elasticsearch-5.4.1.jar:5.4.1]

         ...6 more

Caused by: java.net.BindException: 无法指定被请求的地址

         atsun.nio.ch.Net.bind0(Native Method) ~[?:?]

         atsun.nio.ch.Net.bind(Net.java:433) ~[?:?]

         atsun.nio.ch.Net.bind(Net.java:425) ~[?:?]

         atsun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223)~[?:?]

         atio.netty.channel.socket.nio.NioServerSocketChannel.doBind(NioServerSocketChannel.java:128)~[?:?]

         atio.netty.channel.AbstractChannel$AbstractUnsafe.bind(AbstractChannel.java:554)~[?:?]

         atio.netty.channel.DefaultChannelPipeline$HeadContext.bind(DefaultChannelPipeline.java:1258)~[?:?]

         atio.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:501)~[?:?]

         atio.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:486)~[?:?]

         atio.netty.channel.DefaultChannelPipeline.bind(DefaultChannelPipeline.java:980)~[?:?]

         atio.netty.channel.AbstractChannel.bind(AbstractChannel.java:250) ~[?:?]

         atio.netty.bootstrap.AbstractBootstrap$2.run(AbstractBootstrap.java:365) ~[?:?]

         atio.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163)~[?:?]

         atio.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:403)~[?:?]

         atio.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:462) ~[?:?]

         atio.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)~[?:?]

         atjava.lang.Thread.run(Thread.java:748) [?:1.8.0_161]

原因：elasticsearch.yml文件的参数配置不正确

解决方法：编辑node节点对应的配置文件，例如：

（1）在命令行输入：vim /usr/elk/elasticsearch/elasticsearch-master/config/elasticsearch.yml

  （2）打开文件后，把文件中的这两个地方的IP地址改成ES所在服务器的IP地址即可。

2.问题二：

org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

原因：因为安全问题elasticsearch不让用root用户直接运行，所以要创建新用户

解决：创建一个单独的用户用来运行ElasticSearch

3、问题三：max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

原因：普通用户执行问题

解决：切换到root用户，编辑/etc/security/limits.conf

     添加 elk hard nofile 65536  

  elk soft nofile 65536    (elk是用户名)

4、问题四：max number of threads [1024] for user [elk] is too low, increase to at least [2048]

原因：普通用户执行操作数低

解决：切换超级用户，编辑/etc/security/limits.d/90-nproc.conf

5、问题五：

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

原因：操作系统的vm.max_map_count参数设置太小导致的

解决：切换超级用户，编辑/etc/sysctl.conf

     添加 vm.max_map_count=655360

     保存退出，执行 sysctl -p

6、问题六 system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

原因：

解决：编辑ES配置文件elasticsearch.yml

     添加 bootstrap.system_call_filter: false

7、问题七 启动时，可能会因为非root用户原因，对一些文件没有权限报异常

解决：chown -R xxx path/file 赋予权限 （xxx 为用户名，例如elk）

8、问题八 如遇端口号占用问题

netstat -anp | grep 端口    查出进程号 kill -9 pid

9、问题九 如果在终端出现-bash: grunt: command not found

原因：需要创建软链接

解决: ln -s /usr/elk/node-v6.11.4-linux-x64/bin/grunt(这是grunt快捷方式的路径) /usr/local/bin/grunt