Home / server / Questions

Questions[elasticsearch](server)

Martin Hope
miloske85
Asked: 2016-10-23 11:44:55 +0800 CST
  • 6

I've installed Elastic Search 1.7.4 on CentOS 7.2 this way:

wget https://download.elastic.co/elasticsearch/elasticsearch/elasticsearch-1.7.4.noarch.rpm
sudo rpm -ivh elasticsearch-1.7.4.noarch.rpm

The service is started and ES works (verified with curl), however, it only listens to IPv6 with default configuration. netstat -na gives me the following:

tcp6       0      0 :::9200                 :::*                    LISTEN     
tcp6       0      0 :::9300                 :::*                    LISTEN

Using nmap from other servers I see that ports 9200 and 9300 are filtered, firewall is disabled.

Editing /etc/elasticsearch/elasticsearch.yml and setting:

network.bind_host: 0.0.0.0

doesn't change anything. Setting this to the external IPv4 address of the server does add the additional two entries in netstat -na output, but I need ES to be accessible to my local network, so this is useless and netstat still registers this as tcp6.

tcp6       0      0 192.168.0.54:9200       :::*                    LISTEN     
tcp6       0      0 192.168.0.54:9300       :::*                    LISTEN

setting:

network.bind_host: _eth0:ipv4_

Causes ES to bind to the local IPv4 and then it is of course only available from the local server. Omitting the "ipv4" part causes ES to bind to IPv6 address of the NIC.

How do I enable ES to bind to IPv4? I have no alternative, my network is IPv4 only and I have to use this old version of ES because I'm running some applications that require this version.

centos7 elasticsearch
Martin Hope
alireza
Asked: 2015-06-19 05:26:46 +0800 CST
  • 20

I installed elasticsearch.90.7 with a deb file in ubuntu. I tried to uninstall elasticsearch.90.7 with this command:

sudo apt-get --purge autoremove elasticsearch

And then I downloaded elasticsearch-1.6.0.deb to install elasticsearch 1.6.

When I run this command to install elasticsearch 1.6 by deb file:

dpkg -i elasticsearch-1.6.0.deb

It shows me this:

Selecting previously unselected package elasticsearch.
(Reading database ... 89826 files and directories currently installed.)
Preparing to unpack elasticsearch-1.6.0.deb ...
Creating elasticsearch group... OK
Creating elasticsearch user... OK
Unpacking elasticsearch (1.6.0) ...
Setting up elasticsearch (1.6.0) ...
Processing triggers for ureadahead (0.100.0-16) ...

When I start elasticsearch with service elasticsearch start it's starting, but when i run this command: curl http://localhost:9200

It shows this error: 

curl: (7) Failed to connect to localhost port 9200: Connection refused

I think elasticsearch is not installed properly. I want know what I should do to install elasticsearch properly.

elasticsearch
Martin Hope
anyweez
Asked: 2015-04-06 15:46:59 +0800 CST
  • 9

I've got a Raspberry Pi 2 (latest Raspbian as of Apr 2015) setup that last week was running both ElasticSearch and Logstash on a test network (not a straightforward setup, but it was stable for over a week!). I rebooted my machine today and have been having a really hard time getting things running again; ES and LS will both run independently, but when I try to push LS output into ES the ES instance dies without explanation. My goal is to get both running and LS pumping data into ES via the standard output plugin.

ElasticSearch [v1.5.0]

I believe this is where the core problem is. ES can start up via service elasticsearch start and remains running, is accessible via HTTP requests to port 9200, and all signs of life seem healthy. As soon as something (anything, as far as I can tell) tries to write data to an index, the process dies and debug logs @ /var/log/elasticsearch/* don't contain anything related to service failure. I've tried inserting via logstash (see below) as well as with curl, both of which terminate the ES process. The curl command I'm running is curl -XPOST "http://localhost:9200/logstash-2015.04.05/records/" -d "{ \"type\" : \"specialRecord\" }".

Logstash [v1.4.2]

I'm currently running with this simple config:

input {
    stdin { }
}

output {
        stdout { codec => rubydebug }
        elasticsearch {
                host => '127.0.0.1'
                cluster => 'elasticsearch'
        }
}

Other notes

Some things I've tried:

  • I've tried cranking up logging levels for ElasticSearch to DEBUG / TRACE and the output is remarkably uninteresting. Happy to provide logs if it'd be helpful.

  • I've tried giving ES 256MB and 512MB of heap space, which doesn't seem to affect anything. I've also watched memory utilization during all of this and running out of memory doesn't appear to be a problem.

  • I've tried disabling multicast to try to weed out a bunch of networking variables but that didn't seem to make a difference.

  • I've ensured that the data directory for ES has plenty of space, write permissions, etc. ES creates subdirectories in the path.data directory when it's loaded but I don't believe anything is added since when I restart the ES process the index stats suggest that the total # of documents is zero.

I'm pretty stumped now and disappointed that nothing I need (or at least am able to find) is being logged. Any ideas on what might be going on here?

elasticsearch
Martin Hope
druuu
Asked: 2015-01-23 04:21:59 +0800 CST
  • 7

'Error Could not contact Elasticsearch at http://localhost:9200. Please ensure that Elasticsearch is reachable from your system.'

Currently I am following http://packetbeat.com/getstarted

I installed

  1. elastic search - running on localhost:9200 - returns the json, 2.packetbeat - running,
  2. Kibana on port 8000

Now, I change my kibana/config.js file - enter , 

elasticsearch: "http://"localhost":9200",

under elasticsearch. I get a plain white page with {{dashboard.current.title}} on top.

If I comment out elasticsearch: "http://"localhost":9200",

I get Error Could not contact Elasticsearch at http://localhost:9200. Please ensure that Elasticsearch is reachable from your system.

If I also enter it as elasticsearch: "http://localhost:9200",, I get the same error that it could not contact elasticsearch.

So, I am assuming elasticsearch: "http://"localhost":9200", is right, but it should render something. perhaps a UI

elasticsearch
Martin Hope
mac
Asked: 2014-10-11 01:57:24 +0800 CST
  • 13

I have a CentOS 6.5 server on which I installed Elasticsearch 1.3.2.

My elasticsearch.yml configuration file is a minimal modification of the one shipping with elasticsearch as a default. Once stripped of all commented lines, it looks like:

cluster.name: xxx-kibana

node:
    name: "xxx"
    master: true
    data: true

index.number_of_shards: 5

index.number_of_replicas: 1

path:
    logs: /log/elasticsearch/log
    data: /log/elasticsearch/data


transport.tcp.port: 9300

http.port: 9200

discovery.zen.ping.multicast.enabled: false

Elasticsearch should have compression ON by default, and I read various benchmarks putting the compression ratio from as low as 50% to as high as 95%. Unluckily, the compression ratio in my case is -400%, or in other words: data stored with ES takes 4 times as much disk space than the text file with the same content. See:

12K     logstash-2014.10.07/2/translog
16K     logstash-2014.10.07/2/_state
116M    logstash-2014.10.07/2/index
116M    logstash-2014.10.07/2
12K     logstash-2014.10.07/4/translog
16K     logstash-2014.10.07/4/_state
127M    logstash-2014.10.07/4/index
127M    logstash-2014.10.07/4
12K     logstash-2014.10.07/0/translog
16K     logstash-2014.10.07/0/_state
109M    logstash-2014.10.07/0/index
109M    logstash-2014.10.07/0
16K     logstash-2014.10.07/_state
12K     logstash-2014.10.07/1/translog
16K     logstash-2014.10.07/1/_state
153M    logstash-2014.10.07/1/index
153M    logstash-2014.10.07/1
12K     logstash-2014.10.07/3/translog
16K     logstash-2014.10.07/3/_state
119M    logstash-2014.10.07/3/index
119M    logstash-2014.10.07/3
622M    logstash-2014.10.07/  # <-- This is the total!

versus:

6,3M    /var/log/td-agent/legacy_api.20141007_0.log
8,0M    /var/log/td-agent/legacy_api.20141007_10.log
7,6M    /var/log/td-agent/legacy_api.20141007_11.log
6,7M    /var/log/td-agent/legacy_api.20141007_12.log
8,0M    /var/log/td-agent/legacy_api.20141007_13.log
7,6M    /var/log/td-agent/legacy_api.20141007_14.log
7,6M    /var/log/td-agent/legacy_api.20141007_15.log
7,7M    /var/log/td-agent/legacy_api.20141007_16.log
5,6M    /var/log/td-agent/legacy_api.20141007_17.log
7,9M    /var/log/td-agent/legacy_api.20141007_18.log
6,3M    /var/log/td-agent/legacy_api.20141007_19.log
7,8M    /var/log/td-agent/legacy_api.20141007_1.log
7,1M    /var/log/td-agent/legacy_api.20141007_20.log
8,0M    /var/log/td-agent/legacy_api.20141007_21.log
7,2M    /var/log/td-agent/legacy_api.20141007_22.log
3,8M    /var/log/td-agent/legacy_api.20141007_23.log
7,5M    /var/log/td-agent/legacy_api.20141007_2.log
7,3M    /var/log/td-agent/legacy_api.20141007_3.log
8,0M    /var/log/td-agent/legacy_api.20141007_4.log
7,5M    /var/log/td-agent/legacy_api.20141007_5.log
7,5M    /var/log/td-agent/legacy_api.20141007_6.log
7,8M    /var/log/td-agent/legacy_api.20141007_7.log
7,8M    /var/log/td-agent/legacy_api.20141007_8.log
7,2M    /var/log/td-agent/legacy_api.20141007_9.log
173M    total

What am I doing wrong? Why is data not being compressed?

I have provisionally added index.store.compress.stored: 1 to my configuration file, as I found that in the elasticsearch 0.19.5 release notes (that's when the store compression came out first), but I'm not yet able to tell if it is making a difference, and anyhow compression should be ON by default, nowadays...

elasticsearch