Elasticsearch启动注意

    1. Elasticsearch如果启动在127.0.0.1的话，可以启动成功
    2. Elasticsearch如果要跨机器通讯，需要监听在真实网卡上
    3. 监听在真实网卡需要调整系统参数才能正常启动

    Elasticsearch监听在非127.0.0.1
    4. 监听在0.0.0.0或者内网地址
    5. 以上两种监听都需要调整系统参数
    [root@server11 ~]# vim /usr/local/elasticsearch-6.6.0/config/elasticsearch.yml
    network.host: 0.0.0.0
    [root@server11 ~]# ps aux | grep elasticsearch
    elk 5546 6.9 21.9 2354024 409976 pts/0 Sl 05:52 5:21 /usr/local/jdk1.8.0_201//bin/java -Xms128M -Xmx128M -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.io.tmpdir=/tmp/elasticsearch-3616151938284508963 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintTenuringDistribution -XX:+PrintGCApplicationStoppedTime -Xloggc:logs/gc.log -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=32 -XX:GCLogFileSize=64m -Des.path.home=/usr/local/elasticsearch-6.6.0 -Des.path.conf=/usr/local/elasticsearch-6.6.0/config -Des.distribution.flavor=default -Des.distribution.type=tar -cp /usr/local/elasticsearch-6.6.0/lib/ org.elasticsearch.bootstrap.Elasticsearch -d
    elk 5560 0.0 0.2 72084 5096 pts/0 Sl 05:52 0:00 /usr/local/elasticsearch-6.6.0/modules/x-pack-ml/platform/linux-x86_64/bin/controller
    root 5687 0.0 0.0 112648 964 pts/1 R+ 07:10 0:00 grep —color=auto elasticsearch
    [root@server11 ~]# kill -9 5546
    [root@server11 ~]# ps aux | grep elasticsearch
    root 5689 0.0 0.0 112648 964 pts/1 R+ 07:10 0:00 grep —color=auto elasticsearch
    [elk@server11 ~]$ /usr/local/elasticsearch-6.6.0/bin/elasticsearch –d
    [root@server11 ~]# tail -f /usr/local/elasticsearch-6.6.0/logs/elasticsearch.log
    [2022-03-12T07:11:43,648][INFO ][o.e.b.BootstrapChecks ] [YfBMmRh] bound or publishing to a non-loopback address, enforcing bootstrap checks
    [2022-03-12T07:11:43,713][ERROR][o.e.b.Bootstrap ] [YfBMmRh] node validation exception
    [2] bootstrap checks failed
    [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
    [2]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
    [2022-03-12T07:11:43,716][INFO ][o.e.n.Node ] [YfBMmRh] stopping …
    [2022-03-12T07:11:43,730][INFO ][o.e.n.Node ] [YfBMmRh] stopped
    [2022-03-12T07:11:43,730][INFO ][o.e.n.Node ] [YfBMmRh] closing …
    [2022-03-12T07:11:43,759][INFO ][o.e.n.Node ] [YfBMmRh] closed
    ES启动可能会有三个报错
    [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
    [2]: max number of threads [3829] for user [elk] is too low, increase to at least [4096]
    [3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

    解决方法：
    最大文件打开数调整/etc/security/limits.conf
     - nofile 65536

    最大打开进程数调整/etc/security/limits.d/20-nproc.conf
    注释掉以下两行
    # soft nproc 4096
    #root soft nproc unlimited

    添加这一行     - nproc 10240

    内核参数调整
    vim /etc/sysctl.conf
    vm.max_map_count = 262144
    sysctl -p
    exit

    Elasticsearch监听网卡建议
    6. 如果用作学习，建议监听在127.0.0.1
    7. 如果是云服务器的话，一定把9200和9300公网入口在安全组限制一下
    8. 自建机房的话，建议监听在内网网卡，监听在公网会被入侵

    用网页访问ES
    1.png