Elasticsearch 安装使用过程中踩过的坑，总结出来，希望能帮助遇到同样问题的人。

使用root用户启动失败

报错日志信息：

warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/java/jdk1.8.0_171/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/java/jdk1.8.0_171/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
[2021-05-28T17:36:25,500][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [master] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116) ~[elasticsearch-cli-7.13.0.jar:7.13.0]
	at org.elasticsearch.cli.Command.main(Command.java:79) ~[elasticsearch-cli-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:81) ~[elasticsearch-7.13.0.jar:7.13.0]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
	at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:101) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:168) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:397) ~[elasticsearch-7.13.0.jar:7.13.0]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.13.0.jar:7.13.0]
	... 6 more

报错原因：
elasticsearch 默认不允许 root 用户启动。
解决方案：
创建一个专有用户，授权，然后启动 elasticsearch。
创建用户并授权 elasticsearch 文件夹权限：

adduser elastic
chown -R elastic:elastic  /usr/elk

切换至新用户并启动

su elastic
cd /usr/elk
./masternode/bin/elasticsearch -d
./datanode1/bin/elasticsearch -d

在节点配置中设置了索引信息启动失败

报错日志信息：

warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/java/jdk1.8.0_171/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME
Future versions of Elasticsearch will require Java 11; your Java version from [/usr/java/jdk1.8.0_171/jre] does not meet this requirement. Consider switching to a distribution of Elasticsearch with a bundled JDK. If you are already using a distribution with a bundled JDK, ensure the JAVA_HOME environment variable is not set.
[elastic@gclp-ziyuan elk]$ ps -ef|grep uncaught exception in thread [main]
java.lang.IllegalArgumentException: node settings must not contain any index level settings
	at org.elasticsearch.common.settings.SettingsModule.<init>(SettingsModule.java:132)
	at org.elasticsearch.node.Node.<init>(Node.java:437)
	at org.elasticsearch.node.Node.<init>(Node.java:278)
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:217)
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:217)
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:397)
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
	at org.elasticsearch.cli.Command.main(Command.java:79)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:81)
For complete error details, refer to the log at /usr/elk/masternode/logs/pancm.log

报错原因：
节点设置不能包含任何索引级别设置。
在 elasticsearce.yml 文件中对索引进行了配置，新版本不支持这样配置。
解决方案：
在 elasticsearce.yml 文件中删除相应的索引配置：

# index.number_of_shards: 5
# index.number_of_replicas: 1

用户没有文件访问权限

2021-06-29 10:24:22,428 main ERROR RollingFileManager (/usr/elk/masternode/logs/pancm_server.json) java.io.FileNotFoundException: /usr/elk/masternode/logs/pancm_server.json (Permission denied) java.io.FileNotFoundException: /usr/elk/masternode/logs/pancm_server.json (Permission denied)
	at java.io.FileOutputStream.open0(Native Method)
	at java.io.FileOutputStream.open(FileOutputStream.java:270)
	at java.io.FileOutputStream.<init>(FileOutputStream.java:213)
	at java.io.FileOutputStream.<init>(FileOutputStream.java:133)
	at org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory.createManager(RollingFileManager.java:640)
	at org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory.createManager(RollingFileManager.java:608)
	at org.apache.logging.log4j.core.appender.AbstractManager.getManager(AbstractManager.java:113)
	at org.apache.logging.log4j.core.appender.OutputStreamManager.getManager(OutputStreamManager.java:114)
	at org.apache.logging.log4j.core.appender.rolling.RollingFileManager.getFileManager(RollingFileManager.java:188)
	at org.apache.logging.log4j.core.appender.RollingFileAppender$Builder.build(RollingFileAppender.java:145)
	at org.apache.logging.log4j.core.appender.RollingFileAppender$Builder.build(RollingFileAppender.java:61)
	at org.apache.logging.log4j.core.config.plugins.util.PluginBuilder.build(PluginBuilder.java:123)
	at org.apache.logging.log4j.core.config.AbstractConfiguration.createPluginObject(AbstractConfiguration.java:959)
	at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:899)
	at org.apache.logging.log4j.core.config.AbstractConfiguration.createConfiguration(AbstractConfiguration.java:891)
	at org.apache.logging.log4j.core.config.AbstractConfiguration.doConfigure(AbstractConfiguration.java:514)
	at org.apache.logging.log4j.core.config.AbstractConfiguration.initialize(AbstractConfiguration.java:238)
	at org.apache.logging.log4j.core.config.AbstractConfiguration.start(AbstractConfiguration.java:250)
	at org.apache.logging.log4j.core.LoggerContext.setConfiguration(LoggerContext.java:547)
	at org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:263)
	at org.elasticsearch.common.logging.LogConfigurator.configure(LogConfigurator.java:225)
	at org.elasticsearch.common.logging.LogConfigurator.configure(LogConfigurator.java:118)
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:348)
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159)
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150)
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
	at org.elasticsearch.cli.Command.main(Command.java:79)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:81)

报错原因：
当前用户 elastic 没有 /usr/elk/masternode/logs/pancm_server.json 文件访问权限。
解决方案：
授权

su root
chown -R elastic:elastic  /usr/elk

系统最大文件打开数限制过低

ERROR: [1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.
bootstrap check failure [1] of [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
ERROR: Elasticsearch did not exit normally - check the logs at /usr/elk/masternode/logs/pancm.log

报错原因：
系统的最大打开文件个数限制过低。
解决方案：
使用root用户，编辑文件/etc/security/limits.conf，在文件的末尾处，增加手游参数

elk hard nofile 65536     #elk 为运行ElasticSearch程序的用户
elk soft nofile 65536      #elk 为运行ElasticSearch程序的用户

系统最大线程数限制过低

ERROR: [1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.
bootstrap check failure [1] of [1]: max number of threads [3870] for user [elk] is too low, increase to at least [4096]
ERROR: Elasticsearch did not exit normally - check the logs at /usr/elk/masternode/logs/pancm.log

报错原因：
系统的最大线程数限制过低。
解决方案：
使用root用户，编辑文件/etc/security/limits.conf，在文件的末尾处，增加手游参数

elk hard nproc 4096      #elk 为运行ElasticSearch程序的用户
elk soft nproc 4096       #elk 为运行ElasticSearch程序的用户

内存锁定

ERROR: [1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.
bootstrap check failure [1] of [1]: memory locking requested for elasticsearch process but memory is not locked
ERROR: Elasticsearch did not exit normally - check the logs at /usr/elk/masternode/logs/pancm.log

报错原因：

解决方案：
使用root用户，编辑文件/etc/security/limits.conf，在文件的末尾处，增加手游参数

elk hard memlock unlimited      #elk 为运行ElasticSearch程序的用户
elk soft memlock unlimited       #elk 为运行ElasticSearch程序的用户

error  [03:31:25.547] [fatal][root] Error: listen EADDRNOTAVAIL 172.32.0.33:5601
    at Server.setupListenHandle [as _listen2] (net.js:1343:19)
    at listenInCluster (net.js:1401:12)
    at doListen (net.js:1510:7)
    at _combinedTickCallback (internal/process/next_tick.js:142:11)
    at process._tickCallback (internal/process/next_tick.js:181:9)
    at Function.Module.runMain (module.js:696:11)
    at startup (bootstrap_node.js:204:16)
    at bootstrap_node.js:625:3
 FATAL  Error: listen EADDRNOTAVAIL 172.32.0.33:5601

报错原因：
在机器 172.32.0.31 上部署 kibana ，想连接机器 172.32.0.33 上部署的 elasticsearch 服务，需变更 kibana.yml 配置文件
解决方案：
使用root用户，编辑文件 kibana.yml

server.host: "0.0.0.0"
server.port: 5601
elasticsearch.url: "http:172.32.0.33:9200"

Error: Unable to complete saved object migrations for the [.kibana] index: Unable to complete the INIT step after 15 attempts, terminating.