1、问题一：

org.elasticsearch.bootstrap.StartupException:BindTransportException[Failed to bind to [9300]]; nested: BindException[无法指定被请求的地址];

         atorg.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:127)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:114)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.cli.Command.main(Command.java:88)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84)~[elasticsearch-5.4.1.jar:5.4.1]

Caused by:org.elasticsearch.transport.BindTransportException: Failed to bind to [9300]

         atorg.elasticsearch.transport.TcpTransport.bindToPort(TcpTransport.java:769)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.transport.TcpTransport.bindServer(TcpTransport.java:734)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.transport.netty4.Netty4Transport.doStart(Netty4Transport.java:173)~[?:?]

         atorg.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:69)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.transport.TransportService.doStart(TransportService.java:196)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.common.component.AbstractLifecycleComponent.start(AbstractLifecycleComponent.java:69)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.node.Node.start(Node.java:686) ~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:277)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:359)~[elasticsearch-5.4.1.jar:5.4.1]

         atorg.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:123)~[elasticsearch-5.4.1.jar:5.4.1]

         ...6 more

Caused by: java.net.BindException: 无法指定被请求的地址

         atsun.nio.ch.Net.bind0(Native Method) ~[?:?]

         atsun.nio.ch.Net.bind(Net.java:433) ~[?:?]

         atsun.nio.ch.Net.bind(Net.java:425) ~[?:?]

         atsun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223)~[?:?]

         atio.netty.channel.socket.nio.NioServerSocketChannel.doBind(NioServerSocketChannel.java:128)~[?:?]

         atio.netty.channel.AbstractChannel$AbstractUnsafe.bind(AbstractChannel.java:554)~[?:?]

         atio.netty.channel.DefaultChannelPipeline$HeadContext.bind(DefaultChannelPipeline.java:1258)~[?:?]

         atio.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:501)~[?:?]

         atio.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:486)~[?:?]

         atio.netty.channel.DefaultChannelPipeline.bind(DefaultChannelPipeline.java:980)~[?:?]

         atio.netty.channel.AbstractChannel.bind(AbstractChannel.java:250) ~[?:?]

         atio.netty.bootstrap.AbstractBootstrap$2.run(AbstractBootstrap.java:365) ~[?:?]

         atio.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163)~[?:?]

         atio.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:403)~[?:?]

         atio.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:462) ~[?:?]

         atio.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)~[?:?]

         atjava.lang.Thread.run(Thread.java:748) [?:1.8.0_161]

原因：elasticsearch.yml文件的参数配置不正确

解决方法：编辑node节点对应的配置文件，例如：

（1）在命令行输入：vim /usr/elk/elasticsearch/elasticsearch-master/config/elasticsearch.yml

  （2）打开文件后，把文件中的这两个地方的IP地址改成ES所在服务器的IP地址即可。

 

 

 

2.问题二：

org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

原因：因为安全问题elasticsearch不让用root用户直接运行，所以要创建新用户
解决：创建一个单独的用户用来运行ElasticSearch

 

 

3，问题三：最大文件描述符[4096]对于弹性搜索过程太低，至少增加[65536]

原因
：切换到根用户，编辑/etc/security/limits.conf
     添加麋鹿硬nofile 65536  
  elk soft nofile 65536（elk是用户名）

 

 

4，问题四：用户[elk]的最大线程数[1024]太低，至少增加到[2048]

原因
：切换超级用户，编辑/ etc / security / limits。 d / 90-nproc.conf

 

 

5，问题五：

最大虚拟内存区域vm.max_map_count [65530]太低，增加到至少[262144]

原因：操作系统的vm.max_map_count参数设置太小导致的
解决方案：切换超级用户，编辑/etc/sysctl.conf
     添加vm .max_map_count = 655360
     保存退出，执行sysctl -p

 

 

6，问题六系统调用过滤器安装失败; 检查日志并修复配置或禁用系统调用过滤器需要您自担风险

原因：
解决：编辑ES配置文件elasticsearch.yml
     添加bootstrap.system_call_filter：false


7，问题七启动时，可能会因为非root用户原因，对一些文件没有权限报异常
解决：chown -R xxx path / file赋予权限（xxx为用户名，例如elk）


8，问题八如遇端口号占用问题
netstat -anp | grep端口查出进程号kill -9 pid


9，问题九如果在终端出现-bash：grunt：command not found
原因：需要创建软链接
解决方案：ln -s /usr/elk/node-v6.11.4-linux- x64 / bin / grunt（这是grunt快捷方式的路径）/ usr / local / bin / grunt