Elastic

常见问题

• 开启监听所有外网端口后启动 elasticsearch 报错

network.host: 0.0.0.0

ERROR: [2] bootstrap checks failed
* [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

执行如下命令:

//sudo sysctl -w vm.max_map_count=262144

添加到 /etc/sysctl.conf

vm.max_map_count=262144

并执行命令:

sysctl -p

启动 elastic_search 报错

ERROR: [2] bootstrap checks failed
* [1]: max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]

查看硬限制

Tue Mar 27 10:12:03 coam@bs:/opt/data/elasticsearch-6.4.2 ulimit -Hn
65535

添加下面设置 /etc/security/limits.conf

# End of file
root soft nofile 65535
root hard nofile 65535
* soft nofile 65535
* hard nofile 65535

改为

# End of file
root soft nofile 65536
root hard nofile 65536
* soft nofile 65536
* hard nofile 65536

退出用户重新登录,使配置生效

# ulimit -n 65536

参考

• ES安装问题
• Elasticsearch5.1.1 启动报错

显示所有索引

curl http://localhost:9200/_cat/indices?v

删除指定 Index 数据

curl -XDELETE http://localhost:9200/system-syslog-*
curl -XDELETE http://localhost:9200/filebeat-*

修改 elastic_search 旧数据目录后,启动 kibana 报错:

Another Kibana instance appears to be migrating the index

{"type":"log","@timestamp":"2019-09-26T08:41:30Z","tags":["info","migrations"],"pid":1,"message":"Creating index .kibana_2."}
{"type":"log","@timestamp":"2019-09-26T08:41:30Z","tags":["warning","migrations"],"pid":1,"message":"Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana_2 and restarting Kibana."}
{"type":"log","@timestamp":"2019-09-26T08:42:30Z","tags":["warning","task_manager"],"pid":1,"message":"The task maps_telemetry \"Maps-maps_telemetry\" is not cancellable."}
{"type":"log","@timestamp":"2019-09-26T08:42:30Z","tags":["warning","task_manager"],"pid":1,"message":"The task maps_telemetry \"Maps-maps_telemetry\" is not cancellable."}

看来要把没完成迁移所遗留的 .kibana_* 的 index 删除掉(后面的数字可能不同):

$ curl -XDELETE 'http://localhost:9200/.kibana_2' --header "contentent-type: application/JSON"
{"acknowledged":true}

检查:

$ curl -XGET localhost:9200/.kibana_2

重启 kibana 服务

修复Elasticsearch升级后遇到的问题

中文分词插件

安装,应与安装 elastic_search 的版本一致

/opt/data/elk/elasticsearch

$ ./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.4.2/elasticsearch-analysis-ik-6.4.2.zip
-> Downloading https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.4.2/elasticsearch-analysis-ik-6.4.2.zip
* [=================================================] 100%
-> Installed analysis-ik