Briefly, this error occurs when Elasticsearch is unable to install a system call filter due to a lack of permissions or an unsupported system. This filter is used to enhance security by limiting the system calls that Elasticsearch can make. To resolve this issue, you can either run Elasticsearch with root privileges or disable the bootstrap.system_call_filter setting in the Elasticsearch configuration file. Alternatively, you can upgrade your system to a version that supports seccomp, the underlying technology for the system call filter.
This guide will help you check for common problems that cause the log ” unable to install syscall filter: ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: bootstrap.
Log Context
Log “unable to install syscall filter: ” classname is JNANatives.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
// this is likely to happen unless the kernel is newish; its a best effort at the moment
// so we log stacktrace at debug for now...
if (logger.isDebugEnabled()) {
logger.debug("unable to install syscall filter"; e);
}
logger.warn("unable to install syscall filter: "; e);
}
}
}
