Elasticsearch is a distributed search and analytics engine: full-text search with relevance ranking, aggregations, log analytics and, increasingly, vector search. This guide installs a single node on Ubuntu — the typical setup for a site search, a small logging stack or development.

Licensing note: Elasticsearch is available under the Elastic License / SSPL and, since 2024, also AGPL for the core. If you need an Apache 2.0–licensed alternative, see OpenSearch.

Requirements

  • RAM: 4 GB minimum for a comfortable single node (2 GB works for small tests); Elasticsearch uses a JVM heap plus the OS file cache.
  • Disk: SSD storage; keep 15%+ free (Elasticsearch stops allocating shards at disk watermarks).
  • A recent 64-bit Linux; Java is bundled with the packages.

1. Install from Elastic’s repository

sudo apt install -y apt-transport-https gnupg curl
curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
sudo apt update
sudo apt install -y elasticsearch

Adjust 8.x to the major version you want. Read the installation output: on version 8+, security is enabled automatically and the output shows the generated password for the elastic superuser. Save it. (You can reset it later with sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic.)

2. Basic configuration

/etc/elasticsearch/elasticsearch.yml:

cluster.name: my-search
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 127.0.0.1
http.port: 9200
discovery.type: single-node
  • network.host: 127.0.0.1 keeps it private; your application on the same server connects locally.
  • discovery.type: single-node skips cluster formation checks. (If the auto-configured cluster.initial_master_nodes line exists, remove it when using single-node.)

3. JVM heap

Create /etc/elasticsearch/jvm.options.d/heap.options:

-Xms1g
-Xmx1g

Rules: equal min and max; no more than 50% of RAM (the rest is needed for the file system cache Elasticsearch relies on); never above ~31 GB. On a 4 GB server, 1–2 GB heap is sensible.

4. Start

sudo systemctl daemon-reload
sudo systemctl enable --now elasticsearch
sudo journalctl -u elasticsearch -n 30 --no-pager

Test (security uses HTTPS with an auto-generated certificate):

curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200

You’ll get JSON with the cluster name and version.

5. System limits

The package configures most limits. Check:

sysctl vm.max_map_count     # should be >= 262144

If lower: echo 'vm.max_map_count=262144' | sudo tee /etc/sysctl.d/99-elasticsearch.conf && sudo sysctl --system. Disable swap or set bootstrap.memory_lock: true (with the matching systemd LimitMEMLOCK=infinity) so the heap isn’t swapped.

ES="curl -s --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic:PASSWORD https://localhost:9200"

$ES -X PUT "/products" -H 'Content-Type: application/json' -d '{
  "mappings": { "properties": {
    "name": { "type": "text" },
    "price": { "type": "float" },
    "tags": { "type": "keyword" }
  } }
}'

$ES -X POST "/products/_doc" -H 'Content-Type: application/json' -d '{"name":"Wireless keyboard","price":39.9,"tags":["accessories"]}'

$ES "/products/_search?q=keyboard&pretty"

For applications, create a dedicated user and role with access only to the indices they need (Kibana or the security API), instead of using elastic.

7. Single-node specifics

On one node, replica shards can’t be allocated, so cluster health shows yellow. Set replicas to 0 for your indices:

$ES -X PUT "/products/_settings" -H 'Content-Type: application/json' -d '{"index":{"number_of_replicas":0}}'

Back up with snapshots to a filesystem repository or S3-compatible storage (e.g. MinIO) — copying the data directory of a running node isn’t a valid backup.

Security reminders

Never expose port 9200 publicly. Unsecured Elasticsearch instances have leaked billions of records. Keep it on localhost or a private network, keep security enabled, and update regularly.

For a website or app search box, Meilisearch or Typesense are much lighter (a few hundred MB of RAM) and simpler. See Elasticsearch vs Meilisearch.

  • Elasticsearch
  • Search
  • Ubuntu