Elasticsearch 9

Elasticsearch is a distributed, RESTful search and analytics engine built on Apache Lucene. It is used for full-text search, log aggregation, application monitoring, and real-time data analysis.

Software included

Component	Version
Elasticsearch	9.x
Ubuntu	24.04 LTS

Environment variables

You can optionally set these when deploying Elasticsearch from the marketplace. Leave any field blank to have a secure random value generated automatically.

Variable	Description
`ELASTIC_PASSWORD`	Password for the elastic superuser

Getting started

1. Connect to your VM

ssh ubuntu@<your-vm-ip>

2. Wait for first-boot configuration

On the first boot, a setup script runs automatically. It:

Clears any pre-existing data so the cluster initialises fresh
Sets the cluster name to the VM hostname
Starts Elasticsearch and waits for it to become ready
Resets the elastic superuser password to a randomly generated value
Saves the password to /etc/elasticsearch/elastic-password.txt

Elasticsearch 9 takes 60–90 seconds to start before the password reset can run. Total first-boot time is approximately 2–3 minutes.

Track progress:

journalctl -u elasticsearch-first-boot.service -f

3. Retrieve credentials

sudo cat /etc/elasticsearch/elastic-password.txt

This file contains the elastic superuser password. It is only readable by root.

4. Connect to Elasticsearch

Elasticsearch 9 uses HTTPS with a self-signed certificate by default. Use -k to skip certificate verification for local connections, or use the CA certificate at /etc/elasticsearch/certs/http_ca.crt.

ES_PASS=$(sudo cat /etc/elasticsearch/elastic-password.txt)
curl -k -u elastic:"$ES_PASS" https://localhost:9200

Expected output:

{
  "name" : "your-vm-hostname",
  "cluster_name" : "your-vm-hostname",
  "version" : { ... },
  "tagline" : "You Know, for Search"
}

Managing Elasticsearch

# Check service status
systemctl status elasticsearch

# Restart
sudo systemctl restart elasticsearch

# View logs
sudo journalctl -u elasticsearch -f

Configuration directory: /etc/elasticsearch/

Key files:

elasticsearch.yml: cluster, network, and node settings
jvm.options.d/: JVM heap and GC settings

To adjust the heap size, create a file in /etc/elasticsearch/jvm.options.d/:

-Xms2g
-Xmx2g

Set heap to no more than half the available VM RAM. Restart Elasticsearch after changes.

Security

Ports 9200 (REST API) and 9300 (inter-node transport) are not open externally by default. UFW is enabled and allows SSH (port 22) only.

To allow REST API access from a specific IP:

sudo ufw allow from <trusted-ip> to any port 9200

To connect without opening the firewall (recommended), use an SSH tunnel:

# Run this on your local machine
ssh -L 9200:localhost:9200 ubuntu@<your-vm-ip>

# Then query locally
curl -k -u elastic:"<password>" https://localhost:9200