I googled up this issue on the elasticsearch docker image issue list and the suggestion to use:
sysctl -w vm.max_map_count=262144
on the host running the image resolves the problem. Is there any other/better way to do this?

That's one way to do it, you can make the change permanent by editing the /etc/sysctl.conf file (see #79, #89, and http://elk-docker.readthedocs.io/#troubleshooting).

Even if this value is correct, ES5 won't start anymore in docker with same error here bla bla readonly error.

@x-itec This issue has been pretty much solved for everyone by now, so shouldn't remain a problem: see http://elk-docker.readthedocs.io/#prerequisites for ways around this. If this doesn't solve it:

• Could you post a full output of how you set vm.max_map_count and started the container + output from the container? ("bla bla readonly error" isn't the usual error one gets when the parameter is set incorrectly)

• What are you running Docker on?

• Can you confirm that you have set vm.max_map_count on the host?

• If you bash into the container, has this value been taken into account?

• Depending on your setup, have you tried setting the MAX_MAP_COUNT environment variable?

Hello Guys,

I am getting similar behavior:

root@cfELK:~# sysctl -w vm.max_map_count=262144
sysctl: setting key "vm.max_map_count": Read-only file system

I tried this and it did take but it still doesn't start with the new value
vim /etc/sysctl/sysctl.conf
and added this to the bottom of the file and rebooted the server
vm.max_map_count = 262144

So at this point not sure where to go with this, any help would be appreciated,
Thanks,
Michael

@nexusguy59

root@cfELK:~# sysctl -w vm.max_map_count=262144
sysctl: setting key "vm.max_map_count": Read-only file system

It seems that you're attempting to change the parameter in the container: you need to do it on the host running the container (and check that the value has actually been updated using sysctl vm.max_map_count).

root@cfELK:~# sysctl -w vm.max_map_count=262144 Helped me, Many thanks