在centos6.5系统中，不能直接运行elasticsearch,必须对系统参数进行优化
如果没有优化，会出现如下面的问题
下面我们来进行系统优化吧~~
启动 elasticsearch 如出现异常 can not run elasticsearch as root
解决方法：创建ES 账户，修改文件夹 文件 所属用户 组
启动异常：ERROR: bootstrap checks failed
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
问题原因：因为Centos6不支持SecComp，而ES5.2.1默认bootstrap.system_call_filter为true进行检测，所以导致检测失败，失败后直接导致ES不能启动。详见 ：https://github.com/elastic/elasticsearch/issues/22899
解决方法：在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
启动后，如果只有本地可以访问，尝试修改配置文件 elasticsearch.yml
中network.host(注意配置文件格式不是以 # 开头的要空一格， ： 后要空一格)
为
network.host: 0.0.0.0
默认端口是 9200
注意：关闭防火墙 或者开放9200端口
ERROR: bootstrap checks failed
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
max number of threads [1024] for user [lishang] likely too low, increase to at least [2048]
解决方法：切换到root用户，编辑limits.conf 添加类似如下内容
vi /etc/security/limits.conf
添加如下内容:
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
max number of threads [1024] for user [lish] likely too low, increase to at least [2048]
解决：切换到root用户，进入limits.d目录下修改配置文件。
vi /etc/security/limits.d/90-nproc.conf
修改如下内容：
* soft nproc 1024
#修改为
* soft nproc 2048
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
解决：切换到root用户修改配置sysctl.conf
vi /etc/sysctl.conf
添加下面配置：
vm.max_map_count=655360
并执行命令：
sysctl -p
然后，重新启动elasticsearch，即可启动成功。
ping超时问题
错误的详细信息
09-09T16:08:16,479][WARN ][o.e.d.z.ZenDiscovery ] [log-1] master left (reason = failed to ping, tried [3] times, each with maximum [30s] timeout), current nodes: nodes:
{log-0}{awifQlJfRcKNggd2II3LQQ}{FpEt0t3cRy6eBxiKtPYfRw}{study0}{192.168.137.150:9300}, master
{log-1}{gTsJJfRoRF6hX1vP_TfUiA}{l84qWHqzTdm2wNBGxdpzIg}{study1}{192.168.137.151:9300}, local
[2017-09-09T16:08:19,637][INFO ][o.e.c.s.ClusterService ] [log-1] detected_master {log-0}{awifQlJfRcKNggd2II3LQQ}{FpEt0t3cRy6eBxiKtPYfRw}{study0}{192.168.137.150:9300}, reason: zen-disco-receive(from master [master {log-0}{awifQlJfRcKNggd2II3LQQ}{FpEt0t3cRy6eBxiKtPYfRw}{study0}{192.168.137.150:9300} committed version [141]])
[2017-09-09T16:08:20,647][INFO ][o.e.d.z.ZenDiscovery ] [log-1] master_left [{log-0}{awifQlJfRcKNggd2II3LQQ}{FpEt0t3cRy6eBxiKtPYfRw}{study0}{192.168.137.150:9300}], reason [failed to ping, tried [3] times, each with maximum [30s] timeout]
[2017-09-09T16:08:20,648][WARN ][o.e.d.z.ZenDiscovery ] [log-1] master left (reason = failed to ping, tried [3] times, each with maximum [30s] timeout), current nodes: nodes:
{log-0}{awifQlJfRcKNggd2II3LQQ}{FpEt0t3cRy6eBxiKtPYfRw}{study0}{192.168.137.150:9300}, master
{log-1}{gTsJJfRoRF6hX1vP_TfUiA}{l84qWHqzTdm2wNBGxdpzIg}{study1}{192.168.137.151:9300}, local
解决办法
每一个节点上，elasticsearch.yml 都添加xpack.security.enabled: false
分词器问题
错误日志
[2017-09-10T20:01:22,848][WARN ][o.e.i.c.IndicesClusterStateService] [log-1] [[iktest][4]] marking and sending shard failed due to [failed to create index]
java.lang.IllegalArgumentException: Custom Analyzer [ik] failed to find tokenizer under name [ik_max_word]
at org.elasticsearch.index.analysis.CustomAnalyzerProvider.build(CustomAnalyzerProvider.java:56) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.index.analysis.AnalysisRegistry.processAnalyzerFactory(AnalysisRegistry.java:560) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.index.analysis.AnalysisRegistry.build(AnalysisRegistry.java:490) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.index.analysis.AnalysisRegistry.build(AnalysisRegistry.java:158) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.index.IndexService.<init>(IndexService.java:146) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.index.IndexModule.newIndexService(IndexModule.java:363) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.indices.IndicesService.createIndexService(IndicesService.java:425) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.indices.IndicesService.createIndex(IndicesService.java:390) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.indices.IndicesService.createIndex(IndicesService.java:146) ~[elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.indices.cluster.IndicesClusterStateService.createIndices(IndicesClusterStateService.java:444) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.indices.cluster.IndicesClusterStateService.applyClusterState(IndicesClusterStateService.java:202) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.cluster.service.ClusterService.callClusterStateAppliers(ClusterService.java:856) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.cluster.service.ClusterService.publishAndApplyChanges(ClusterService.java:810) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.cluster.service.ClusterService.runTasks(ClusterService.java:628) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.cluster.service.ClusterService$UpdateTask.run(ClusterService.java:1112) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:527) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedEsThreadPoolExecutor.java:238) [elasticsearch-5.2.0.jar:5.2.0]
at org.elasticsearch.common.util.concurrent.PrioritizedEsThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedEsThreadPoolExecutor.java:201) [elasticsearch-5.2.0.jar:5.2.0]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]
解决办法
scp -r ik study@study1:/usr/local/es/elasticsearch-5.2.0/plugins
每一个节点都安装一下分词器插件
