ELK Stack — Install Elasticsearch

Install Elasticsearch

Elasticsearch is the core of the ELK Stack. Let’s install it step by step.

System Requirements

Requirement	Minimum	Recommended
RAM	4 GB	8 GB+
Disk	10 GB	50 GB+ (SSD preferred)
CPU	2 cores	4+ cores
Java	Bundled (OpenJDK)	Use bundled version
OS	Ubuntu 20.04+, CentOS 7+, macOS	Ubuntu 22.04, CentOS 8+

Method 1 — Install on Ubuntu/Debian

Step 1 — Import the Elastic GPG Key

$ wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

Step 2 — Add the Elastic APT Repository

$ echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

Step 3 — Install Elasticsearch

$ sudo apt update && sudo apt install elasticsearch -y

Expected output (important — save this!):

--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the superuser is : <RANDOM_PASSWORD>

The enrollment token for Kibana instances, valid for the next 30 minutes:
  <ENROLLMENT_TOKEN>

The hex-encoded SHA-256 fingerprint of the generated HTTPS CA DER encoded certificate:
  <FINGERPRINT>

Save the password and enrollment token! You’ll need them to connect Kibana.

Step 4 — Configure Elasticsearch

Edit the configuration file:

$ sudo nano /etc/elasticsearch/elasticsearch.yml

Key settings:

# Cluster name (all nodes in a cluster must share this)
cluster.name: my-elk-cluster

# Node name (unique per node)
node.name: node-1

# Network binding (default: localhost only)
network.host: 0.0.0.0

# Discovery (single-node for learning)
discovery.type: single-node

# HTTP port (default: 9200)
http.port: 9200

For a single-node learning setup, these settings are sufficient.

Step 5 — Configure JVM Heap Size

Elasticsearch runs on the JVM and needs adequate heap memory:

$ sudo nano /etc/elasticsearch/jvm.options.d/heap.options

Add:

-Xms2g
-Xmx2g

Rules of thumb:

• Set -Xms and -Xmx to the same value (avoids resizing pauses)
• Never exceed 50% of total system RAM
• Never exceed 32 GB (JVM compressed OOPs limit)
• For learning: 1-2 GB is fine

Step 6 — Start Elasticsearch

$ sudo systemctl daemon-reload
$ sudo systemctl enable elasticsearch
$ sudo systemctl start elasticsearch

Step 7 — Verify Installation

$ curl -k -u elastic:<YOUR_PASSWORD> https://localhost:9200

Expected output:

{
  "name" : "node-1",
  "cluster_name" : "my-elk-cluster",
  "cluster_uuid" : "abc123...",
  "version" : {
    "number" : "8.15.0",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "...",
    "build_date" : "...",
    "build_snapshot" : false,
    "lucene_version" : "9.11.1",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

If you see this JSON response, Elasticsearch is running successfully!

Method 2 — Install on CentOS/RHEL

Step 1 — Import the GPG Key

$ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

Step 2 — Add the Elastic YUM Repository

$ sudo tee /etc/yum.repos.d/elasticsearch.repo << 'EOF'
[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

Step 3 — Install and Start

$ sudo yum install elasticsearch -y
$ sudo systemctl daemon-reload
$ sudo systemctl enable elasticsearch
$ sudo systemctl start elasticsearch

Method 3 — Install on macOS (Homebrew)

$ brew tap elastic/tap
$ brew install elastic/tap/elasticsearch-full

Start Elasticsearch:

$ elasticsearch

Resetting the Password

If you lost the auto-generated password:

$ sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

Expected output:

New value for the elastic user: <NEW_PASSWORD>

Generating a New Enrollment Token

If you need a new token for Kibana:

$ sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

Check Cluster Health

$ curl -k -u elastic:<PASSWORD> https://localhost:9200/_cluster/health?pretty

Expected output:

{
  "cluster_name" : "my-elk-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 1,
  "active_shards" : 1,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "number_of_pending_tasks" : 0
}

Health status meanings:

• green — all shards are allocated (healthy)
• yellow — primary shards are allocated, but some replicas are not (single-node clusters are always yellow unless configured otherwise)
• red — some primary shards are unallocated (data may be unavailable)

Common Installation Issues

Issue	Solution
max virtual memory areas vm.max_map_count [65530] is too low	Run: sudo sysctl -w vm.max_map_count=262144
Elasticsearch won’t start	Check logs: sudo journalctl -u elasticsearch
Connection refused on port 9200	Verify: sudo systemctl status elasticsearch
Out of memory	Reduce heap: edit jvm.options.d/heap.options
Certificate errors with curl	Use -k flag to skip certificate verification for local testing

Important File Locations

File	Path
Configuration	/etc/elasticsearch/elasticsearch.yml
JVM options	/etc/elasticsearch/jvm.options
Data directory	/var/lib/elasticsearch
Log directory	/var/log/elasticsearch
Binaries	/usr/share/elasticsearch/bin/
Plugins	/usr/share/elasticsearch/plugins/

Quick Reference

Task	Command
Start ES	sudo systemctl start elasticsearch
Stop ES	sudo systemctl stop elasticsearch
Check status	sudo systemctl status elasticsearch
View logs	sudo journalctl -u elasticsearch -f
Reset password	sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic
Test connection	curl -k -u elastic:<PASS> https://localhost:9200
Cluster health	curl -k -u elastic:<PASS> https://localhost:9200/_cluster/health?pretty

Next Step

Elasticsearch is running! Now let’s install Kibana and connect it to our Elasticsearch instance.