Docker部署ELK日志分析时,粗心可能会报的错误:
ERROR: bootstrap checks failed
elasticsearch运行时报以下错误:
max number of threads [1024] for user [lish] likely too low, increase to at least [2048]
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
方法:
使用vim /etc/security/limits.conf
修改系统参数
添加如下内容:
* soft nofile 65535
* hard nofile 65535
* soft nproc 65535
* hard nproc 65535
* soft memlock unlimited
* hard memlock unlimited
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
方法:
使用vim /etc/sysctl.conf
修改系统参数
添加下面配置:
vm.max_map_count=655360
##保存后执行
sysctl -p
然后,重新启动elasticsearch,即可启动成功。
Logstash Configuration Contains a Syntax Error
logstash 语法错误,主要是logstash配置文件不对导致的。
方法:
进入logstash容器检查配置文件或在启动logstash前,仔细检查一下logstash配置文件。