問題一：
[2016-11-06T16:27:21,712][WARN ][o.e.b.JNANatives ] unable to install syscall filter: Java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMPandCONFIG_SECCOMP_FILTERcompiledinatorg.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.java:349) ~[elasticsearch-5.0.0.jar:5.0.0] at org.elasticsearch.bootstrap.Seccomp.init(Seccomp.java:630) ~[elasticsearch-5.0.0.jar:5.0.0]
原因：報了一大串錯誤，大家不必驚慌，其實只是一個警告，主要是因為你Linux版本過低造成的。
解決方案：
1、重新安裝新版本的Linux系統
2、警告不影響使用，可以忽略
問題二：
ERROR: bootstrap checks failed max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
原因：無法創建本地文件問題,用戶最大可創建文件數太小
解決方案：
切換到root用戶，編輯limits.conf配置文件， 添加類似如下內容：
vi /etc/security/limits.conf 添加如下內容: * soft nofile 65536 * hard nofile 131072 * soft nproc 2048 * hard nproc 4096
備注：* 代表Linux所有用戶名稱（比如 hadoop）
保存、退出、重新登錄才可生效
問題三：
max number of threads [1024] for user [es] likely too low, increase to at least [2048]
原因：無法創建本地線程問題,用戶最大可創建線程數太小
解決方案：
切換到root用戶，進入limits.d目錄下，修改90-nproc.conf 配置文件。
vi /etc/security/limits.d/90-nproc.conf 找到如下內容： * soft nproc 1024 #修改為 * soft nproc 2048
問題四：
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
原因：最大虛擬內存太小
解決方案：切換到root用戶下，修改配置文件sysctl.conf
vi /etc/sysctl.conf 添加下面配置： vm.max_map_count=655360 並執行命令： sysctl -p
然后重新啟動elasticsearch，即可啟動成功。
問題五：
ElasticSearch啟動找不到主機或路由
原因：ElasticSearch 單播配置有問題
解決方案：
檢查ElasticSearch中的配置文件
vi config/elasticsearch.yml 找到如下配置： discovery.zen.ping.unicast.hosts:["192.168.**.**:9300","192.168.**.**:9300"]
一般情況下，是這里配置有問題，注意書寫格式
問題六：
org.elasticsearch.transport.RemoteTransportException: Failed to deserialize exception response from stream
原因:ElasticSearch節點之間的jdk版本不一致
解決方案：ElasticSearch集群統一jdk環境
問題七：
Unsupported major.minor version 52.0
原因：jdk版本問題太低
解決方案：更換jdk版本，ElasticSearch5.0.0支持jdk1.8.0
問題八：
bin/elasticsearch-plugin install license ERROR: Unknown plugin license
原因：ElasticSearch5.0.0以后插件命令已經改變
解決方案：使用最新命令安裝所有插件
bin/elasticsearch-plugin install x-pack
memory locking requested for elasticsearch process but memory is not locked
配置了bootstrap.memory_lock:true
https://www.elastic.co/guide/en/elasticsearch/reference/current/_memory_lock_check.html
max number of threads [1024] for user [admin] is too low, increase to at least [2048]
ulimit -u 2048
nproc –>/etc/security/limits.conf
https://www.elastic.co/guide/en/elasticsearch/reference/master/max-number-of-threads.html
[WARN ][o.e.b.JNANatives ] unable to install syscall filter:
Java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
常見異常
注意：yml配置文件的值前有一個空格隔開
max number of threads [1024] for user [admin] is too low, increase to at least [2048]
原因：用戶允許最大線程數首先
vi bin/elasticsearch
ulimit -u 2048 //僅供測試使用
Warning: Ignoring JAVA_OPTS=…….
Please pass JVM parameters via ES_JAVA_OPTS instead
vi bin/elasticsearch
添加如下配置項：
JAVA_HOME=”/export/servers/jdk1.8.0_60”
JAVA_OPTS=”“
JAVA_OPTS配置為空，是為了不受系統配置的環境變量的影響
can not run elasticsearch as root
不能以root用戶啟動ES服務器。非要以root用戶運行？
配置 -Des.insecure.allow.root=true
對於5.X，在config/jvm.options配置文件中，添加-Des.insecure.allow.root=true
內存鎖定:
解決方法1：配置 config/elasticsearch.yml ，注釋掉以下內容
#bootstrap.memory_lock: true
解決方法2：配置：/etc/security/limits.conf,
admin soft memlock unlimited
admin hard memlock unlimited
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
Your kernel does not support seccomp.
Elasticsearch attempts to utilize seccomp by default (via the setting bootstrap.system_call_filter).
Starting in 5.2.0, if you’re in production mode, bootstrap.system_call_filter is enabled, and initializing seccomp fails, then Elasticsearch will refuse to bootstrap.
You either have to migrate to a kernel that supports seccomp, or disable bootstrap.system_call_filter.
Centos6不支持SecComp，而ES5.2.0默認bootstrap.system_call_filter為true
禁用：在elasticsearch.yml中配置bootstrap.system_call_filter為false，注意要在Memory下面:
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
配置IP和http端口，TCP端口默認在HTTP端口上加100
network.host: 192.168.179.20
http.port: 9201
path.conf is not a recognized option
之前的配置： –path.conf=E{ES_CONF}
unknown setting [path.plugins]
https://www.elastic.co/guide/en/elasticsearch/reference/5.0/breaking_50_plugins.html#_custom_plugins_path
specify a custom plugins path via path.plugins has been removed.
node settings must not contain any index level settings
Since elasticsearch 5.x index level settings can NOT be set on the nodes
configuration like the elasticsearch.yaml, in system properties or command line
arguments.
curl -XPUT ‘http://localhost:9200/_all/_settings?preserve_existing=true’ -d ‘{
“index.number_of_shards” : “3”
}’
curl -XPUT ‘http://localhost:9200/_all/_settings?preserve_existing=true’ -d ‘{
“index.mapper.dynamic” : “false”,
“index.translog.durability” : “async”,
“index.translog.sync_interval” : “30s”
}’
即以index開頭的配置刪除。
unknown setting [bootstrap.mlockall]
修改為： bootstrap.memory_lock: true
unknown setting [action.disable_delete_all_indices]
新配置：action.destructive_requires_name: true