ELK-5.4.1搭建日誌管理系統（二）ES安裝時遇到的一些問題

安裝配置Elasticsearch5.4.1的時候遇到的一些問題，經過查找資料解決。整理記錄一下，便於之後遇到一樣的問題可以快速解決。

Elasticsearch安裝好後，默認只容許經過127.0.0.1訪問，若是咱們但願在另一臺機器上訪問Elasticsearch的話，須要修改主機配置：

#network.host: 192.168.0.1 
networ.host: 192.168.5.82 <--修改成本機iP，或者0.0.0.0

保存退出後，從新啓動Elasticsearch的話會報錯，沒法啓動。報錯以下：

[WARN ][o.e.b.JNANatives         ] unable to install syscall filter: 
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
ERROR: [4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [elsearch] is too low, increase to at least [2048]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk　　

WARN:只是一個警告，使用新版本的linux就沒事了。

錯誤一：max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

修改/etc/security/limits.conf配置文件，添加以下內容：

# vim /etc/security/limits.conf 
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096

錯誤二：max number of threads [1024] for user [elsearch] is too low, increase to at least [2048]

修改/etc/security/limits.d/90-nproc.conf配置文件，修改內容以下： 

# vim /etc/security/limits.d/90-nproc.conf
* soft nproc 1024
#修改成
* soft nproc 2048

錯誤三：max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

修改配置文件/etc/sysctl.conf，修改內容以下：

# vim /etc/sysctl.conf
添加下面配置：
vm.max_map_count = 655360

錯誤四：system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk緣由：

這是在由於操做系統不支持SecComp，而ES5.4.1默認bootstrap.system_call_filter爲true進行檢測，因此致使檢測失敗，失敗後直接致使ES不能啓動。
解決：
在elasticsearch.yml中配置bootstrap.system_call_filter爲false，注意要在Memory下面:

bootstrap.memory_lock: false
bootstrap.system_call_filter: false

修改好後重啓ES，可以正常啓動。