当我们在使用elasticsearch的时候，如果是以root权限来执行elasticsearch
./elasticsearch
则会有以下报错
Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root.
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:94)
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:160)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:286)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
Refer to the log for complete error details.
这是出于系统安全考虑设置的条件。由于ElasticSearch可以接收用户输入的脚本并且执行，为了系统安全考虑，建议创建一个单独的用户用来运行ElasticSearch
创建elsearch用户组及elsearch用户
groupadd elsearch
useradd elsearch -g elsearch -p elasticsearch
更改elasticsearch文件夹及内部文件的所属用户及组为elsearch:elsearch
cd /opt
chown -R elsearch:elsearch elasticsearch
切换到elsearch用户再启动
su elsearch #切换账户
cd elasticsearch/bin #进入你的elasticsearch目录下的bin目录
./elasticsearch
启动后会打印正常启动日志信息如下
[elsearch@localhost elasticsearch-2.4.0]$ ./bin/elasticsearch
[2016-12-7 09:00:07,658][INFO ][node] [Black Bolt] version[2.4.0], pid[25504], build[ce9f0c7/2016-08-29T09:14:17Z]
[2016-12-7 09:00:07,674][INFO ][node] [Black Bolt] initializing ...
[2016-12-7 09:00:08,248][INFO ][plugins] [Black Bolt] modules [lang-groovy, reindex, lang-expression], plugins [elasticsearch-analysis-ik, head], sites [head]
[2016-12-7 09:00:08,267][INFO ][env] [Black Bolt] using [1] data paths, mounts [[/home (/dev/mapper/centos-home)]], net usable_space [172.1gb], net total_space [172.9gb], spins? [possibly], types [xfs]
[2016-12-7 09:00:08,267][INFO ][env] [Black Bolt] heap size [990.7mb], compressed ordinary object pointers [true]
[2016-12-7 09:00:08,268][WARN ][env] [Black Bolt] max file descriptors [4096] for elasticsearch process likely too low, consider increasing to at least [65536]
[2016-12-7 09:00:09,561][INFO ][ik-analyzer] [Dict Loading] ik/custom/mydict.dic
[2016-12-7 09:00:09,579][INFO ][ik-analyzer] [Dict Loading] ik/custom/single_word_low_freq.dic
[2016-12-7 09:00:09,589][INFO ][ik-analyzer] [Dict Loading] ik/custom/ext_stopword.dic
[2016-12-7 09:00:09,935][INFO ][node] [Black Bolt] initialized
[2016-12-7 09:00:09,935][INFO ][node] [Black Bolt] starting ...
[2016-12-7 09:00:09,975][INFO ][transport] [Black Bolt] publish_address {172.17.0.1:9300}, bound_addresses {[::]:9300}
[2016-12-7 09:00:09,979][INFO ][discovery] [Black Bolt] elasticsearch/YGWbxIWSRyejtiM4WqHwAA
[2016-12-7 09:00:13,003][INFO ][cluster.service] [Black Bolt] new_master {Black Bolt}{YGWbxIWSRyejtiM4WqHwAA}{172.17.0.1}{172.17.0.1:9300}, reason: zen-disco-join(elected_as_master, [0] joins received)
[2016-12-7 09:00:13,010][INFO ][http] [Black Bolt] publish_address {172.17.0.1:9200}, bound_addresses {[::]:9200}
[2016-12-7 09:00:13,010][INFO ][node] [Black Bolt] started
[2016-12-7 09:00:13,323][INFO ][gateway] [Black Bolt] recovered [1] indices into cluster_state
[2016-12-7 09:00:15,576][INFO ][cluster.routing.allocation] [Black Bolt] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[sports][2]] ...]).
之后如果再启动的话（如果是以root权限登录服务器），只需要执行切换账户，然后运行elasticsearch就可以了
su elsearch #切换账户
cd elasticsearch/bin #进入你的elasticsearch目录下的bin目录
./elasticsearch
ElasticSearch后端启动命令
./elasticsearch -d