1. elasticsearch 400错误，
原因主要是没把hadoop文本转化为Json格式，引入Gson解决。
add jar file:///opt/spacewalk/xj6500_data/lib/gson-2.2.4.jar;
2.classnotFound---EsOutputFormat，
主要是运行的时候没加依赖包，
add jar file:///opt/spacewalk/xj6500_data/lib/elasticsearch-hadoop-5.5.2.jar;
3.ES启动错误
2017-01-12T16:12:22,404][INFO ][o.e.b.BootstrapCheck ] [SfD5sIh] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
ERROR: bootstrap checks failed
initial heap size [536870912] not equal to maximum heap size [1073741824]; this can cause resize pauses and prevents mlockall from locking the entire heap
解决方法：
//es配置文件
vi config/jvm.options
//-Xms 和 -Xmx需要配置的相等，不然无法启动成功。
-Xms1024m
-Xmx1024m
4.ES启动错误
error1：
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
max number of threads [1024] for user [lishang] likely too low, increase to at least [2048]
解决：切换到root用户，编辑limits.conf 添加类似如下内容
vi /etc/security/limits.conf
添加如下内容:
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
error2：
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
解决：切换到root用户修改配置sysctl.conf
vi /etc/sysctl.conf
添加下面配置：
vm.max_map_count=655360
并执行命令：
sysctl -p
然后，重新启动elasticsearch，即可启动成功。
5.启动异常
当我在开启多个elasticsearch 实例时，遇到上述异常，解决方法是：在 config/elasticsearch.yml文件中新增一个配置变量：
node.max_local_storage_nodes: 256 #replace 256 with another num that greater than 1