elasticsearch 常见问题

elasticsearch 常见问题

一系列elasticsearch 问题和解决方法。持续更新…

bootstrap checks failed

system call filters failed

1
2
ERROR: bootstrap checks failed
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

因为Centos6不支持SecComp,而ES默认bootstrap.system_call_filter为true进行检测,所以导致检测失败,失败后直接导致ES不能启动。在elasticsearch.yml中配置bootstrap.system_call_filter为false可以解决这个问题。

memory locking requested for elasticsearch process but memory is not locked

修改 /etc/security/limits.conf

1
2
*** soft memlock unlimited
*** hard memlock unlimited

*** 是elasticsearch 的启动用户

修改 /etc/sysctl.conf

1
vm.swappiness=0

修改完后,重启机器。

MaxBytesLengthExceededException

1
IllegalArgumentException[Document contains at least one immense term in field="requestBody" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms. The prefix of the first immense term is: '[86, 78, 49, 66, 55, 81, 86, 115, 74, 100, 85, 120, 98, 112, 73, 122, 67, 78, 77, 71, 116, 81, 107, 53, 65, 79, 90, 120, 119, 120]...', original message: bytes can be at most 32766 in length; got 45000]; nested: MaxBytesLengthExceededException[bytes can be at most 32766 in length; got 45000];

问题原因:

设置为keyword类型的字段不会被分词器处理,最大支持的byte长度是32766.在长度超出范围后,会报错。

解决方案:

  1. 在mapping中对该字段设置ignore_above属性,该属性设置字符长度上限,超出部分会被直接丢弃。注意,如果是使用UTF-8字符集时,最好设置为32766 / 4 = 8191。因为UTF-8字符最多占据4bytes。
  2. 将该字段改为text类型:支持分词、全文检索,不支持聚合、排序操作。text类型无长度上限

can not run elasticsearch as root

由于安全问题elasticsearch 不让用root用户直接运行,所以要创建新用户来执行elasticsearch。

1
2
3
4
groupadd elastic
useradd elastic -g elastic
chown -R elastic:elastic elasticsearch-5.6.8
# 以elastic 用户启动 bin/elasticsearch

max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

elasticsearch用户拥有的可创建文件描述的权限太低,至少需要65536。修改文件/etc/security/limits.conf.

1
2
*** hard nofile 65536
*** soft nofile 65536

*** 是启动ES的用户,修改后重启。

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

elasticsearch用户拥有的内存权限太小,至少需要262144;修改文件/etc/sysctl.conf

1
vm.max_map_count=262144

修改后重启。

-------------本文结束感谢您的阅读-------------
坚持分享,您的支持将鼓励我继续创作!
0%