問題一：ElasticsearchException[Failed to create native process factories for Machine（系統找不到指定的文件。)
該錯誤解決方案
在Elasticsearch/config/elasticsearch.yml加入以下參數:
action.auto_create_index: .security,.monitoring*,.watches,.triggered_watches,.watcher-history*
xpack.security.enabled: false
xpack.monitoring.enabled: true
xpack.graph.enabled: false
xpack.watcher.enabled: false
xpack.ml.enabled: false
==========================================================
問題二：max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
問題詳情
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
解決方案
# 每個進程最大同時打開文件數太小，可通過下面2個命令查看當前數量
ulimit -Hn
ulimit -Sn
# 修改/etc/security/limits.conf文件，增加配置，用戶退出後重新登錄生效
* soft nofile 65536
* hard nofile 65536
如圖
==========================================================
問題三：max number of threads [3818] for user [es] is too low, increase to at least [4096]
問題：
max number of threads [3818] for user [es] is too low, increase to at least [4096]
解決：
# 最大線程個數太低。可通過命令查看
ulimit -Hu
ulimit -Su
# 修改/etc/security/limits.conf文件，增加配置，用戶退出後重新登錄生效
* soft nproc 4096
* hard nproc 4096
==========================================================
問題四：max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
問題：
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
解決方案：
# 修改/etc/sysctl.conf文件，增加配置vm.max_map_count=262144
# 編輯
vim /etc/sysctl.conf
# 配置
vm.max_map_count=262144
# 生效
sysctl -p 或 sudo sysctl -p（用第二種是因爲之前改完還出現啓動不了的情況）
==========================================================
問題五：[1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
問題：
[1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
解決:
# 修改 config/elasticsearch.yml 取消註釋保留一個節點即可
cluster.initial_master_nodes: ["node-1"]
==========================================================
問題六：Exception in thread “main” java.nio.file.AccessDeniedException: /usr/local/elasticsearch/elasticsearch-6.2.2-1/config/jvm.options
問題：
Exception in thread "main" java.nio.file.AccessDeniedException: /usr/local/elasticsearch/elasticsearch-6.2.2-1/config/jvm.options
解決：
# ElasticSearch 不支持使用 root 權限運行，需要創建一個用戶並授權 ES 目錄給這個用戶
# 添加用戶
useradd elk
# 給用戶設置密碼
passwd elk
# 更改目錄所有者
chown -R elk /usr/local/apps/es/
# 目錄下文件權限配置
chmod -R 755 /usr/local/apps/es/
# 切換 elk 用戶
su elk
# 執行 bin/elasticsearch 即可
./bin/elasticsearch
==========================================================
問題七：本地通過 ip:9200 訪問不到 elasticsearch 服務
問題：
本地通過ip:9200訪問不到elasticsearch服務
解決：
# 修改 config/elasticsearch.yml
network.host: 0.0.0.0
==========================================================
問題八：elasticsearch 不能再root用戶下啓動
問題：
Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root.
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:93)
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:144)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:285)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
Refer to the log for complete error details.
解決：
打印信息：
[2015-12-30 10:15:44,876][WARN ][bootstrap ] unable to install syscall filter: prctl(PR_GET_NO_NEW_PRIVS): Invalid argument
[2015-12-30 10:15:45,175][INFO ][node ] [Grim Hunter] version[2.1.1], pid[26383], build[40e2c53/2015-12-15T13:05:55Z]
[2015-12-30 10:15:45,176][INFO ][node ] [Grim Hunter] initializing ...
[2015-12-30 10:15:45,243][INFO ][plugins ] [Grim Hunter] loaded [], sites []
[2015-12-30 10:15:45,272][INFO ][env ] [Grim Hunter] using [1] data paths, mounts [[/ (/dev/mapper/vg_yong-lv_root)]], net usable_space [33.3gb], net total_space [49gb], spins? [no], types [ext4]
[2015-12-30 10:15:47,318][INFO ][node ] [Grim Hunter] initialized
[2015-12-30 10:15:47,318][INFO ][node ] [Grim Hunter] starting ...
[2015-12-30 10:15:47,388][INFO ][discovery ] [Grim Hunter] elasticsearch/fnXUCLOQQBiC1aR7hhB82Q
[2015-12-30 10:15:50,442][INFO ][cluster.service ] [Grim Hunter] new_master {Grim Hunter}{fnXUCLOQQBiC1aR7hhB82Q}{127.0.0.1}{127.0.0.1:9300}, reason: zen-disco-join(elected_as_master, [0] joins received)
[2015-12-30 10:15:50,491][INFO ][node ] [Grim Hunter] started
[2015-12-30 10:15:50,526][INFO ][gateway ] [Grim Hunter] recovered [0] indices into cluster_state
ElasticSearch後端啓動命令：
./elasticsearch -d
參考：https://my.oschina.net/topeagle/blog/591451?fromerr=mzOr2qzZ