elk（單機）安裝過程中遇到的問題及解決方法

1、記憶體不夠

Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x00000006c5330000, 4207738880, 0) failed; error='Cannot allocate memory' (errno=12)

#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 2103864440 bytes for committing reserved memory.
# An error report file with more information is saved as:
# /home/user/hs_err_pid1375.log

elk預設啟動需要2g的記憶體，可以根據本機環境調整

vi ./elasticsearch-5.1.1/config/jvm.options
-Xms2g
-Xmx2g

2、其他主機不可訪問

curl: connect to address : Connection refused

調整防火牆

vi /etc/sysconfig/iptables

-A INPUT -m state --state NEW -m tcp -p tcp --dport 9200 -j ACCEPT
service iptables restart

調整elk配置

vi ./elasticsearch-5.1.1/config/elasticsearch.yml
network.host: 0.0.0.0

3、max file descriptor

ERROR: bootstrap checks failed
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

vi /etc/security/limits.conf 
* hard nofile 65536
* soft nofile 65536

4、max number of threads

max number of threads [1024] for user [user] is too low, increase to at least [2048]
vi /etc/security/limits.d/90-nproc.conf
*          soft    nproc     2048

5、max virtual memory areas

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
1 sysctl -w vm.max_map_count=262144
2 vi /etc/sysctl.conf 

vm.max_map_count=262144

6、設定/etc/security/limits.d/90-nproc.conf後，仍報錯

ERROR: bootstrap checks failed
max number of threads [1876] for user [work] is too low, increase to at least [2048]

查詢虛擬機器記憶體，如果記憶體較低，就會影響實際的最大執行緒數