ELK问题合集（20200910）
1.[2018-08-05T04:51:57,668][INFO ][o.e.x.s.a.AuthenticationService] [elk_server01] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
解决方法：重新配置set-passwords ,确保密码是正确的
2.[2018-08-05T05:58:35,906][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<ArgumentError: Setting "xpack.security.enabled" hasn't been registered>, :backtrace=>["/data/www/logstash_nginx/logstash-core/lib/logstash/settings.rb:37:in `get_setting'", "/data/www/logstash_nginx/logstash-core/lib/logstash/settings.rb:70:in `set_value'", "/data/www/logstash_nginx/logstash-core/lib/logstash/settings.rb:89:in `block in merge'", "org/jruby/RubyHash.java:1343:in `each'", "/data/www/logstash_nginx/logstash-core/lib/logstash/settings.rb:89:in `merge'", "/data/www/logstash_nginx/logstash-core/lib/logstash/settings.rb:138:in `validate_all'", "/data/www/logstash_nginx/logstash-core/lib/logstash/runner.rb:264:in `execute'", "/data/www/logstash_nginx/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/data/www/logstash_nginx/logstash-core/lib/logstash/runner.rb:219:in `run'", "/data/www/logstash_nginx/vendor/bundle/jruby/2.3.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/data/www/logstash_nginx/lib/bootstrap/environment.rb:67:in `<main>'"]} [2018-08-05T05:58:35,924][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit
3.failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin] 
解决方法：如果配置了x-pack ssl, 需要确认集群内的p12都一致，否则会导致报上面的错
4.2018-08-07T16:49:08.550+0800 ERROR instance/beat.go:667 Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: fail to get the Kibana version:HTTP GET request to /api/status fails: 401 Unauthorized. Response: {"statusCode":401,"error":"Unauthorized"}. Exiting: Error importing Kibana dashboards: fail to create the Kibana loader: Error creating Kibana client: fail to get the Kibana version:HTTP GET request to /api/status fails: 401 Unauthorized. Response: {"statusCode":401,"error":"Unauthorized"}.
解决方法：filebeat 连接kabana需要认证
5.Caused by: java.lang.IllegalArgumentException: can't add node {es-pro-111}{YbCoBMn4T266mbxkc85NmQ}{ihdBdmJ1RD65D3JO6RCKhw}{10.xx.xx.xx}{10.xx.xx.xx:9300}{drt}{xpack.installed=true, transform.node=true}, found existing node {es-pro-11}{YbCoBMn4T266mbxkc85NmQ}{OtQXcJBkQH2ndVMd0ObDng}{10.xx.xx.xx}{10.xx.xx.xx:9300}{dmrt}{xpack.installed=true, transform.node=true} with the same id but is a different node instance
解决方法：这个问题是由于你在其他地方同步过来es的时候,把data的数据也同步了，所以会导致提示 the same id but is a different node instance, 把这个节点es存储数据的目录下面的数据全删掉，再重启就可以了
