Docker ELK启动报错：Can't move to stopped state when not started

这个警告是Elasticsearch启动失败后，尝试停止未成功初始化的组件抛出的，核心问题是ES本身未能正常启动，以下是根因分析和修复方案：

核心根因 #

1. 缺失单节点配置：未设置discovery.type=single-node，ES默认以集群模式启动，单节点环境下会因无法发现其他节点启动失败。
2. 证书挂载不完整：ES容器仅挂载了elasticsearch节点的证书，未挂载CA证书目录，导致ES无法验证SSL证书。
3. 证书权限错误：setup服务将证书权限设置为root:root，但ES容器默认使用elasticsearch用户（UID 1000），无读取权限。
4. 环境变量冲突：ELASTICSEARCH_HOSTS设置为HTTP地址，但ES已启用HTTPS，协议不匹配导致启动失败。

修复步骤 #

1. 修正Elasticsearch服务配置 #

补充单节点配置与修复证书挂载

修改elasticsearch服务的volumes和environment：

elasticsearch:
  image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
  container_name: elasticsearch
  depends_on:
      setup:
        condition: service_healthy
  volumes:
    - ./certs/elasticsearch:/usr/share/elasticsearch/config/certs
    - ./certs/ca:/usr/share/elasticsearch/config/certs/ca  # 新增CA证书挂载
    - ./elasticsearch/data:/usr/share/elasticsearch/data
    - ./elasticsearch/logs:/usr/share/elasticsearch/logs/
  ports:
    - '9200:9200'
  environment:
    - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}  # 移除多余的ELASTIC_USERNAME，默认用户是elastic
    - bootstrap.memory_lock=true
    - discovery.type=single-node  # 新增单节点配置
    - xpack.security.enabled=true
    - xpack.security.http.ssl.enabled=true
    - xpack.security.http.ssl.key=certs/elasticsearch/elasticsearch.key
    - xpack.security.http.ssl.certificate=certs/elasticsearch/elasticsearch.crt
    - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
    - xpack.security.transport.ssl.enabled=true
    - xpack.security.transport.ssl.key=certs/elasticsearch/elasticsearch.key
    - xpack.security.transport.ssl.certificate=certs/elasticsearch/elasticsearch.crt
    - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
    - xpack.security.transport.ssl.verification_mode=certificate
    - xpack.license.self_generated.type=${LICENSE}
    - ES_JAVA_OPTS=-Xms2g -Xmx2g
  ulimits:
    memlock:
      soft: -1
      hard: -1
  healthcheck:
    test:
      [
        "CMD-SHELL",
        "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
      ]
    interval: 10s
    timeout: 10s
    retries: 120

2. 修正setup服务的证书权限 #

修改setup服务中设置权限的命令，将证书所有者改为ES容器的用户：

setup:
  # ... 其他配置不变
  command: >
    bash -c '
      # ... 前面的逻辑不变
      echo "Setting file permissions"
      chown -R 1000:0 config/certs;  # 替换原来的chown -R root:root
      find . -type d -exec chmod 750 \{\} \;;
      find . -type f -exec chmod 640 \{\} \;;
      # ... 后面的逻辑不变
    '

3. 修正Logstash的配置问题（额外优化） #

挂载本地日志目录并修正证书路径

Logstash无法直接读取宿主机的D:/logs，需要挂载目录，同时确保CA证书路径正确：

logstash:
  image: docker.elastic.co/logstash/logstash:${STACK_VERSION}
  container_name: logstash
  depends_on:
    setup:
      condition: service_healthy
    elasticsearch:
      condition: service_healthy
    # 移除不必要的kibana依赖
  user: root
  volumes:
    - ./logstash/data:/usr/share/logstash/data
    - ./certs/ca:/usr/share/logstash/certs/ca  # 挂载CA证书
    - ./logstash/pipeline/logstash.conf:/usr/share/logstash/pipeline/logstash.conf:ro
    - D:/logs:/host/logs  # 挂载宿主机日志目录到容器
  environment:
    - xpack.monitoring.enabled=false
    - ELASTIC_USER=${ELASTIC_USERNAME}
    - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
    - ELASTIC_HOSTS=https://elasticsearch:9200
  command: logstash -f /usr/share/logstash/pipeline/logstash.conf
  ports:
    - "5044:5044/udp"

同时修改Logstash的logstash.conf中的日志路径：

input {
    file {
        type => "users-ws-log"
        path => "/host/logs/users-ws.log"  # 改为容器内挂载路径
    }
    file {
        type => "accounts-ws-log"
        path => "/host/logs/accounts-ws.log"
    }
}
# ... 输出配置不变

验证修复 #

1. 删除之前生成的证书和ES数据目录：

rm -rf ./certs ./elasticsearch/data

2. 重新启动Docker Compose：

docker-compose up -d

3. 检查ES状态：

curl --cacert ./certs/ca/ca.crt -u elastic:${ELASTIC_PASSWORD} https://localhost:9200

内容的提问来源于stack exchange，提问作者davidvera