ERROR: [2] bootstrap checks failed. You must address the points described in the following [2] lines before starting Elasticsearch.
bootstrap check failure [1] of [2]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
bootstrap check failure [2] of [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
主要是文件權限與內存大小問題：
elasticsearch用戶擁有的可創建文件描述的權限太低，至少需要65536,
處理辦法: #切換到root用戶修改
vim /etc/security/limits.conf # 在最后面追加下面內容
elk hard nofile 65536
elk soft nofile 65536 #*** 是啟動elk的用戶
max_map_count文件包含限制一個進程可以擁有的VMA(虛擬內存區域)的數量
處理辦法: #切換到root用戶修改
vim /etc/sysctl.conf # 在最后面追加下面內容
vm.max_map_count=655360
執行 sysctl -p