1.內(nèi)存不足

[sandwich@centos-elk bin]$ ./logstash -e 'input {input stdin{}} output{stdout{}}'
Using LS_JAVA_HOME defined java: /home/sandwich/app/elk/elasticsearch-7.17.1/jdk.
WARNING: Using LS_JAVA_HOME while Logstash distribution comes with a bundled JDK.
OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000d5550000, 715849728, 0) failed; error='Not enough space' (errno=12)
#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 715849728 bytes for committing reserved memory.
# An error report file with more information is saved as:
# /home/sandwich/app/elk/logstash-7.17.1/bin/hs_err_pid35687.log

這種錯(cuò)誤會(huì)根據(jù)pid打印到錯(cuò)誤日志里面

[sandwich@centos-elk bin]$ ls -lrt | grep pid
-rw-rw-r--. 1 sandwich sandwich 24253 Apr 23 21:43 hs_err_pid34878.log
-rw-rw-r--. 1 sandwich sandwich 24187 Apr 24 02:59 hs_err_pid35512.log
-rw-rw-r--. 1 sandwich sandwich 24038 Apr 24 03:06 hs_err_pid35687.log

加內(nèi)存就完了

2.Pipelines YAML file is empty

[sandwich@centos-elk bin]$ ./logstash
Using LS_JAVA_HOME defined java: /home/sandwich/app/elk/elasticsearch-7.17.1/jdk.
WARNING: Using LS_JAVA_HOME while Logstash distribution comes with a bundled JDK.
Sending Logstash logs to /home/sandwich/app/elk/logstash-7.17.1/logs which is now configured via log4j2.properties
[2022-04-24T03:30:18,875][INFO ][logstash.runner          ] Log4j configuration path used is: /home/sandwich/app/elk/logstash-7.17.1/config/log4j2.properties
[2022-04-24T03:30:18,898][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.17.1", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 17.0.2+8 on 17.0.2+8 +indy +jit [linux-x86_64]"}
[2022-04-24T03:30:18,902][INFO ][logstash.runner          ] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -Djruby.regexp.interruptible=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED]
ERROR: Pipelines YAML file is empty. Location: /home/sandwich/app/elk/logstash-7.17.1/config/pipelines.yml
usage:
  bin/logstash -f CONFIG_PATH [-t] [-r] [] [-w COUNT] [-l LOG]
  bin/logstash --modules MODULE_NAME [-M "MODULE_NAME.var.PLUGIN_TYPE.PLUGIN_NAME.VARIABLE_NAME=VALUE"] [-t] [-w COUNT] [-l LOG]
  bin/logstash -e CONFIG_STR [-t] [--log.level fatal|error|warn|info|debug|trace] [-w COUNT] [-l LOG]
  bin/logstash -i SHELL [--log.level fatal|error|warn|info|debug|trace]
  bin/logstash -V [--log.level fatal|error|warn|info|debug|trace]
  bin/logstash --help
[2022-04-24T03:30:19,537][FATAL][org.logstash.Logstash    ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
    at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?]
    at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?]
    at home.sandwich.app.elk.logstash_minus_7_dot_17_dot_1.lib.bootstrap.environment.<main>(/home/sandwich/app/elk/logstash-7.17.1/lib/bootstrap/environment.rb:94) ~[?:?]

當(dāng)啟動(dòng)的時(shí)候不加任何參數(shù)，默認(rèn)就需要讀logstash-7.17.1/config/pipelines.yml指定的config.
這個(gè)時(shí)候pipelines.yml是空的就會(huì)報(bào)錯(cuò)毒嫡。
如果啟動(dòng)的時(shí)候帶了config相關(guān)的command line options參數(shù)或者已經(jīng)指定了module五辽，它會(huì)直接讀傳過(guò)去的參數(shù)好乐，忽略pipelines.yml

nohup /home/sandwich/app/elk/logstash-7.17.1/bin/logstash -f /home/sandwich/app/elk/logstash-7.17.1/config/logstash.conf >> /home/sandwich/app/elk/logstash-7.17.1/startup.log 2>&1 &

也是會(huì)忽略pipelines.yml

3.FATAL Error: [config validation of [elasticsearch].password]: expected value of type [string] but got [number]

這里就是往keystore添加密碼的時(shí)候希望是string格式搁拙，但是輸入的是number格式
這就是純數(shù)字密碼在這里導(dǎo)致的問(wèn)題掺炭，建議把密碼改成帶字符的辫诅。

4.重置密碼報(bào)錯(cuò)(./elasticsearch-setup-passwords interactive)

在我們?cè)O(shè)置了密碼之后，想更新密碼報(bào)錯(cuò)如下

[sandwich@centos-elk bin]$ ./elasticsearch-setup-passwords interactive

Failed to authenticate user 'elastic' against http://192.168.32.3:9200/_security/_authenticate?pretty
Possible causes include:
 * The password for the 'elastic' user has already been changed on this cluster
 * Your elasticsearch node is running against a different keystore
   This tool used the keystore at /home/sandwich/app/elk/elasticsearch-7.17.1/config/elasticsearch.keystore


ERROR: Failed to verify bootstrap password

解決辦法：
確認(rèn)是否有.security-7索引

5.setting [cluster.initial_master_nodes] is not allowed when [discovery.type] is set to [single-node]

這個(gè)是因?yàn)榕渲昧藛喂?jié)點(diǎn)的時(shí)候跟以下配置有沖突了

cluster.initial_master_nodes: ["es1"]

把這個(gè)注釋掉就好了么夫。

6.IOException[keystore password was incorrect]

啟動(dòng)https后添加如下配置

xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.authc.api_key.enabled: true
xpack.security.http.ssl.keystore.path: elastic-certificates.p12
xpack.security.http.ssl.truststore.path: elastic-certificates.p12

重啟后爆出如下詳細(xì)異常：

ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.http.ssl]]; nested: ElasticsearchException[failed to initialize SSL TrustManager]; nested: IOException[keystore password was incorrect]; nested: UnrecoverableKeyException[failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.];
Likely root cause: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
        at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2159)
        at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:221)
        at java.base/java.security.KeyStore.load(KeyStore.java:1473)

再添加證書(shū)keystore加密的密碼就好了

[sandwich@centos-elk config]$ tail -n 2 elasticsearch.yml
xpack.security.http.ssl.keystore.password: bbbbbb
xpack.security.http.ssl.truststore.password: bbbbbb