1.linux下启动es不能用root
groupadd -g 700 elasticsearch3——>新建用户组，组名叫elasticsearch3
useradd -u 701 -g 700 elasticsearch3——->新建用户，用户名叫elasticsearch3
passwd elasticsearch3——->设置用户密码为elasticsearch3
gpasswd -a elasticsearch3 elasticsearch3—–>将用户添加到用户组里面，第一个elasticsearch3表示用户名，第二个elasticsearch3表示组名
给elasticsearch付权限
chown -R elasticsearch3:elasticsearch3 /usr/local/elasticsearch-5.4.1/
因为Centos6不支持SecComp，而ES5.2.0默认bootstrap.system_call_filter为true进行检测，所以导致检测失败，失败后直接导致ES不能启动。
在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
问题：
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
max number of threads [1024] for user [hadoop] is too low, increase to at least [2048]
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
解决方案：
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
切换到root用户
ulimit -Hn 查看硬限制
vim /etc/security/limits.conf
添加下面设置 hadoop是用户
hadoop soft nofile 65536
hadoop hard nofile 65536
退出用户重新登录，使配置生效
重新 ulimit -Hn 查看硬限制 会发现数值有4096改成65535
vim /etc/security/limits.d/90-nproc.conf
找到如下内容：
soft nproc 1024
修改为
soft nproc 2048
vi /etc/sysctl.conf
添加下面配置：
vm.max_map_count=655360
并执行命令：
sysctl -p