Logstash（Windows）报错

解决ELK Stack中Elasticsearch启动异常及Logstash日志输出问题

最新推荐文章于 2025-10-06 11:50:15 发布

原创最新推荐文章于 2025-10-06 11:50:15 发布 · 420 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#elasticsearch

本文档描述了在Windows环境下，使用ELK Stack (版本6.5.0)时遇到的Elasticsearch和Logstash运行异常。Logstash日志显示Elasticsearch的9200端口可能被占用，导致无法建立连接。ES启动日志指出可能是因为同一存储节点多次启动，建议检查node.max_local_storage_nodes配置。解决方案包括：通过netstat命令查询9200端口占用情况，使用taskkill命令结束相关进程，然后重新启动ES和Logstash。通过这些步骤，可以尝试修复服务并恢复正常运行。

服务器：Windows
版本：ELK(ES-Logstash-Kibana)版本6.5.0

Logstash日志输出报错：

[2020-05-19T10:10:50,867][INFO ][logstash.outputs.elasticsearch] 
Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}

[2020-05-19T10:10:50,869][INFO ][logstash.outputs.elasticsearch] 
Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http:/ /localhost:9200/, :path=>"/"} 

[2020-05-19T10:10:55,837][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http:/ /localhost:9200/, :path=>"/"}

ES启动日志输出报错：

org.elasticsearch.bootstrap.StartupException:java.lang.IllegalStateException: failed to obtain node locks, tried [[C:\ES\elasticsearch-6.5.0\data\elasticsearch]] with lock id [0]; maybe these locations are not writable or multiple nodes were started without increasing [node.max_local_storage_nodes] (was [1])?