ELK报错

1、elsticsearch7.8.0启动报错

elsticsearch7.8.0内置有jdk，不需要提供本地Java环境

ERROR: [1] bootstrap checks failed
[1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

vim /usr/local/elasticsearch-7.8.0/config/elasticsearch.yml

image.png

2、es启动报错

Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000400000000, 17179869184, 0) failed; error='Not enough space' (errno=12)

解决方法：
调整jvm.options文件中指定的es启动时jvm大小

3、kibana启动报错

（1）

[root@es-3 kibana-7.8.0-linux-x86_64]# tailf nohup.out 
Kibana should not be run as root.  Use --allow-root to continue.

加上参数启动
[root@es-3 kibana-7.8.0-linux-x86_64]# nohup ./bin/kibana --allow-root &

（2）
FATAL Error: [elasticsearch.url]: definition for this key is missing

把url改为hosts
![image.png](https://upload-images.jianshu.io/upload_images/21295118-16a0fb4e4be66602.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
然后重新启动
###4、filebeat启动报错
```Exiting: 1 error: setting 'filebeat.prospectors' has been removed```

[root@es-2 conf.d]# cd /usr/local/filebeat/
[root@es-2 filebeat]# vim filebeat.yml

![image.png](https://upload-images.jianshu.io/upload_images/21295118-2af87bdc7c02f6b5.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)

###5、logstash启动报错401
可能是因为es集群为安全起见安装了安全插件X-pack，设置了登录的用户名和密码，所以需要在logstash中配置es的账户名密码

output {
elasticsearch {
...
user => logstash_internal
password => changeme
}
}