How to Install Elasticsearch on Ubuntu 24.04

Elasticsearch is a distributed, open-source search engine built on Apache Lucene. It stores and retrieves large volumes of structured, unstructured, and vector data with high speed and scalability. It is commonly used as part of the Elastic Stack alongside Logstash and Kibana for logging, analytics, and full-text search.

In this article, you will install Elasticsearch on Ubuntu 24.04, configure it for secure local access, test its functionality, and secure it with Let's Encrypt SSL certificates and Nginx as a reverse proxy.

Prerequisites

Before you begin, you need to:

• Have access to an Ubuntu 24.04 server as a non-root user with sudo privileges.
• A DNS record pointing to your server’s IP address, such as www.example.com.

Install Dependencies

Install Certbot and Nginx to prepare for securing Elasticsearch with SSL.

1. Update your system’s package list.

   CONSOLE

   Copy

   $ sudo apt update

   Explain Code

   Powered by Vultr AgentBeta

2. Install Certbot, Nginx, and the Nginx plugin.

   CONSOLE

   Copy

   $ sudo apt install -y certbot nginx python3-certbot-nginx

   Explain Code

   Powered by Vultr AgentBeta

Install Elasticsearch

Elasticsearch is not available in Ubuntu’s default package repositories. Add the official Elastic APT repository and install it as follows:

1. Import the Elasticsearch GPG signing key.

   CONSOLE

   Copy

   $ curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
     sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

   Explain Code

   Powered by Vultr AgentBeta

2. Add the Elasticsearch APT source list.

   CONSOLE

   Copy

   $ echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | \
     sudo tee /etc/apt/sources.list.d/elastic-8.x.list

   Explain Code

   Powered by Vultr AgentBeta

3. Update your package list again to include the new repository.

   CONSOLE

   Copy

   $ sudo apt update

   Explain Code

   Powered by Vultr AgentBeta

4. Install Elasticsearch.

   CONSOLE

   Copy

   $ sudo apt install -y elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

Configure Elasticsearch

Restrict Elasticsearch to listen only on localhost to prevent external access.

1. Open the Elasticsearch configuration file.

   CONSOLE

   Copy

   $ sudo nano /etc/elasticsearch/elasticsearch.yml

   Explain Code

   Powered by Vultr AgentBeta

2. Find the following line (usually near the bottom) and replace or add it to restrict access to localhost:

   YAML

   Copy

   network.host: 127.0.0.1

   Explain Code

   Powered by Vultr AgentBeta

   Setting network.host to 127.0.0.1 ensures Elasticsearch is not exposed to external networks.

   Save the file and exit.

Manage the Elasticsearch Service

Restart and enable the Elasticsearch service to apply changes and ensure it starts on boot.

1. Reload systemd to register service changes.

   CONSOLE

   Copy

   $ sudo systemctl daemon-reload

   Explain Code

   Powered by Vultr AgentBeta

2. Restart the Elasticsearch service.

   CONSOLE

   Copy

   $ sudo systemctl restart elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

3. Enable Elasticsearch to start automatically on reboot.

   CONSOLE

   Copy

   $ sudo systemctl enable elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

4. Verify that the service is active and running.

   CONSOLE

   Copy

   $ sudo systemctl status elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

Test Elasticsearch

Verify that Elasticsearch is working by allowing required firewall ports, resetting the default user password, and querying the API.

1. Allow HTTP and HTTPS ports.

   CONSOLE

   Copy

   $ sudo ufw allow 80/tcp
   $ sudo ufw allow 443/tcp

   Explain Code

   Powered by Vultr AgentBeta

2. Enable the firewall.

   CONSOLE

   Copy

   $ sudo ufw enable

   Explain Code

   Powered by Vultr AgentBeta

3. Confirm that the rules are active.

   CONSOLE

   Copy

   $ sudo ufw status

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   Status: active
   
   To                         Action      From
   --                         ------      ----
   22/tcp                     ALLOW       Anywhere                  
   80/tcp                     ALLOW       Anywhere                  
   443/tcp                    ALLOW       Anywhere                  
   22/tcp (v6)                ALLOW       Anywhere (v6)             
   80/tcp (v6)                ALLOW       Anywhere (v6)             
   443/tcp (v6)               ALLOW       Anywhere (v6)

4. Reset the elastic user password.

   CONSOLE

   Copy

   $ sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

   Explain Code

   Powered by Vultr AgentBeta

   The command above generates and displays a new password for the elastic user, which you will use in the next step.

5. Test the Elasticsearch API with the generated password.

   CONSOLE

   Copy

   $ curl -u elastic:<password> -k https://127.0.0.1:9200

   Explain Code

   Powered by Vultr AgentBeta

   Replace <password> with the value generated in the previous step to authenticate the request. The -k option skips SSL certificate validation.

   Note

   Elasticsearch enables authentication by default since version 8.0. Resetting the elastic user password is required for API access.

   The response should resemble:

   {
      "name": "vultr",
      "cluster_name": "elasticsearch",
      "cluster_uuid": "495uUfkmREWsiiHmXwoY5Q",
      "version": {
          "number": "8.18.2",
          "build_flavor": "default",
          "build_type": "deb",
          "build_hash": "c6b8d8d951c631db715485edc1a74190cdce4189",
          "build_date": "2025-05-23T10:07:06.210694702Z",
          "build_snapshot": false,
          "lucene_version": "9.12.1",
          "minimum_wire_compatibility_version": "7.17.0",
          "minimum_index_compatibility_version": "7.0.0"
      },
      "tagline": "You Know, for Search"
   }

   This confirms that Elasticsearch is functioning and accessible via a secure API.

Secure Elasticsearch

To enable secure remote access, use Let's Encrypt SSL certificates with an Nginx reverse proxy.

1. Create a new reverse proxy configuration for Nginx.

   CONSOLE

   Copy

   $ sudo nano /etc/nginx/sites-available/elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

2. Add the following configuration and replace www.example.com accordingly.

   INI

   Copy

   server {
       listen 80;
       server_name www.example.com;
   
       location / {
           proxy_pass https://localhost:9200;
           proxy_ssl_verify off;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
       }
   }

   Explain Code

   Powered by Vultr AgentBeta

3. Enable the new Elasticsearch reverse proxy.

   CONSOLE

   Copy

   $ sudo ln -s /etc/nginx/sites-available/elasticsearch /etc/nginx/sites-enabled/

   Explain Code

   Powered by Vultr AgentBeta

4. Restart Nginx.

   CONSOLE

   Copy

   $ sudo systemctl restart nginx

   Explain Code

   Powered by Vultr AgentBeta

5. Request a TLS certificate using Certbot.

   CONSOLE

   Copy

   $ sudo certbot --nginx -d www.example.com

   Explain Code

   Powered by Vultr AgentBeta

   After completing the prompt, Certbot stores the certificates at:

   • /etc/letsencrypt/live/www.example.com/fullchain.pem
   • /etc/letsencrypt/live/www.example.com/privkey.pem

6. Remove the default Nginx site.

   CONSOLE

   Copy

   $ sudo rm /etc/nginx/sites-enabled/default

   Explain Code

   Powered by Vultr AgentBeta

7. Open your browser and visit https://www.example.com.

   You should see a login prompt:

   

8. Log in using the elastic user and password to reach the homepage.

   

   This confirms that Elasticsearch is securely accessible over HTTPS.

Conclusion

In this article, you installed Elasticsearch on Ubuntu 24.04, restricted its access to localhost, reset the elastic user password, verified its API functionality, and secured remote access using Let's Encrypt SSL certificates with an Nginx reverse proxy. This setup provides a secure and production-ready Elasticsearch environment.

For advanced use cases and cluster management, refer to the official Elasticsearch documentation.