ELKB5.3 遇到的问题介绍

Posted 2020-09-12

问题1：

[[email protected] bin]$ OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000094cc0000, 1798569984, 0) failed; error=‘Cannot allocate memory‘ (errno=12)

#

# There is insufficient memory for the Java Runtime Environment to continue.

# Native memory allocation (mmap) failed to map 1798569984 bytes for committing reserved memory.

# An error report file with more information is saved as:

# /usr/local/elasticsearch-5.3.0/bin/hs_err_pid16731.log

解决方法：

You have configured a virtual machine with 1 GB of RAM, but elastic is trying to start with 2 GB of RAM (default for Elasticsearch version 5.X)

5.X版本 Elasticsearch安装需要2G以上内存

问题2：

max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决方法：

echo "* soft nofile 65536" >> /etc/security/limits.conf

echo "* hard nofile 131072" >> /etc/security/limits.conf

echo "* soft nproc 2048" >> /etc/security/limits.conf

echo "* hard nproc 4096" >> /etc/security/limits.conf

sysctl -w vm.max_map_count=262144

filebeat中moduel的使用方法

filebeat.yml配置如下：

filebeat.modules:
#-------------------------------- nginx Module -------------------------------
- module: nginx
  #Access logs
  access:
    enabled: true
  error:
    enabled: true
#-------------------------- Elasticsearch output -------------------------------
output.elasticsearch:
  enabled: true
  hosts: ["192.168.2.209:9200"]

elasticsearch安装如下插件  

bin/elasticsearch-plugin install ingest-user-agent
bin/elasticsearch-plugin install ingest-geoip

备注：使用模块的话必须使用 Elasticsearch output，否者会报错

Exiting: Filebeat modules configured but the Elasticsearch output is not configured/enabled

本文出自 “宁静致远” 博客，请务必保留此出处http://irow10.blog.51cto.com/2425361/1917115