How to Use Vultr's Elasticsearch Marketplace Application

Elasticsearch is a distributed, open-source search and analytics engine built on Apache Lucene. It delivers real-time indexing, full-text search, aggregations, and vector-based retrieval at scale. The Vultr Marketplace provides a pre-configured Elasticsearch instance, enabling quick deployment and setup on a Vultr server.

This guide explains deploying and using Vultr's Elasticsearch Marketplace Application. You will deploy an instance, configure security, verify health, index and search data, set up snapshots to Vultr Object Storage, and add basic monitoring and integrations.

Deploy Vultr's Elasticsearch Marketplace Application

1. Log in to your Vultr Console and click the Deploy Server button.

2. Select your preferred server type.

3. Choose a server location.

4. Select a server plan with at least 4GB RAM and 2 CPU cores for production workloads.

5. Click the Configure button to proceed.

6. Under Marketplace Apps, search for Elasticsearch and select it as the Marketplace Application.

7. Select the Limited Login option from the Additional Features section to create a limited user with sudo access.

8. Review your configurations and click the Deploy Now button to start deployment.

   Note

   It may take up to 10 minutes for your server to finish installing Elasticsearch.

9. After the instance shows the status of Running, navigate to the Server Overview page and copy the SSH connection details.

Initial Setup and Configuration

After deployment, complete essential baseline tasks to make the instance reachable and secure. You will map a friendly domain, confirm service health, lock down network access, and enable built-in security before exposing the HTTP API to the internet.

1. Create a DNS A record pointing to your server's IP address, such as elastic.example.com.

2. Connect to your Vultr server instance over SSH using the connection details from the Server Information page.

Verify Elasticsearch Installation

1. Check the Elasticsearch service status.

   CONSOLE

   Copy

   $ sudo systemctl status elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

   The service should show as active (running).

2. Verify the installed Elasticsearch version.

   CONSOLE

   Copy

   $ sudo /usr/share/elasticsearch/bin/elasticsearch -V

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   Version: 8.19.5, Build: deb/d6dd0417f05cd69706f4f103c69bbb8b7688db9c/2025-10-03T16:35:50.165700789Z, JVM: 25

Configure Firewall Security

Secure your server by configuring the firewall to allow only necessary traffic.

1. Allow SSH connections.

   CONSOLE

   Copy

   $ sudo ufw allow OpenSSH

   Explain Code

   Powered by Vultr AgentBeta

2. Allow HTTP and HTTPS traffic for Nginx and Certbot.

   CONSOLE

   Copy

   $ sudo ufw allow 80/tcp
   $ sudo ufw allow 443/tcp

   Explain Code

   Powered by Vultr AgentBeta

3. Enable the firewall.

   CONSOLE

   Copy

   $ sudo ufw enable

   Explain Code

   Powered by Vultr AgentBeta

4. Verify firewall status.

   CONSOLE

   Copy

   $ sudo ufw status

   Explain Code

   Powered by Vultr AgentBeta

   Port 9200 is used by Elasticsearch's HTTP API. You will remove this rule after enabling SSL through the Nginx reverse proxy.

Configure Reverse Proxy with Nginx

Set up Nginx as a reverse proxy to serve Elasticsearch over standard HTTPS port with authentication, securing public access.

1. Install the Nginx web server package.

   CONSOLE

   Copy

   $ sudo apt install nginx -y

   Explain Code

   Powered by Vultr AgentBeta

2. Create a password file for basic authentication.

   CONSOLE

   Copy

   $ sudo apt install apache2-utils -y
   $ sudo htpasswd -c /etc/nginx/.htpasswd admin

   Explain Code

   Powered by Vultr AgentBeta

   Enter a secure password when prompted. This creates the admin user for accessing Elasticsearch.

3. Create an Nginx virtual host configuration for Elasticsearch.

   CONSOLE

   Copy

   $ sudo nano /etc/nginx/sites-available/elasticsearch

   Explain Code

   Powered by Vultr AgentBeta
   INI

   Copy

   server {
       listen 80;
       server_name elastic.example.com;
   
       auth_basic "Elasticsearch Authentication";
       auth_basic_user_file /etc/nginx/.htpasswd;
   
       location / {
           proxy_pass http://localhost:9200;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
           proxy_read_timeout 300;
           proxy_send_timeout 300;
       }
   }

   Explain Code

   Powered by Vultr AgentBeta

   Replace elastic.example.com with your domain name.

   Save and close the file.

4. Enable the Elasticsearch server block.

   CONSOLE

   Copy

   $ sudo ln -s /etc/nginx/sites-available/elasticsearch /etc/nginx/sites-enabled/

   Explain Code

   Powered by Vultr AgentBeta

5. Test the Nginx configuration syntax.

   CONSOLE

   Copy

   $ sudo nginx -t

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
   nginx: configuration file /etc/nginx/nginx.conf test is successful

6. Reload Nginx to apply the changes.

   CONSOLE

   Copy

   $ sudo systemctl reload nginx

   Explain Code

   Powered by Vultr AgentBeta

Secure Elasticsearch with Public SSL/TLS

Enable HTTPS access through the Nginx reverse proxy using Let's Encrypt certificates.

1. Install Certbot and the Nginx plugin.

   CONSOLE

   Copy

   $ sudo apt install certbot python3-certbot-nginx -y

   Explain Code

   Powered by Vultr AgentBeta

2. Request an SSL certificate for your domain.

   CONSOLE

   Copy

   $ sudo certbot --nginx -d elastic.example.com

   Explain Code

   Powered by Vultr AgentBeta

   Follow the prompts and select the option to redirect HTTP traffic to HTTPS when asked.

3. Verify SSL certificate auto-renewal.

   CONSOLE

   Copy

   $ sudo certbot renew --dry-run

   Explain Code

   Powered by Vultr AgentBeta

4. Access Elasticsearch securely at https://elastic.example.com.

5. Test the public endpoint with basic authentication:

   CONSOLE

   Copy

   $ curl -X GET "https://elastic.example.com/" -u admin:YOUR_PASSWORD

   Explain Code

   Powered by Vultr AgentBeta

   You can now use this public HTTPS endpoint for external access, while server-side commands can continue using http://localhost:9200.

6. Close direct port 9200 access now that traffic goes through the Nginx reverse proxy.

   CONSOLE

   Copy

   $ sudo ufw delete allow 9200/tcp

   Explain Code

   Powered by Vultr AgentBeta

Configure OS-Level Tuning

Elasticsearch requires specific operating system settings for optimal performance and stability.

1. Increase the virtual memory map count.

   CONSOLE

   Copy

   $ sudo sysctl -w vm.max_map_count=262144

   Explain Code

   Powered by Vultr AgentBeta

2. Disable swap to prevent performance degradation.

   CONSOLE

   Copy

   $ sudo swapoff -a

   Explain Code

   Powered by Vultr AgentBeta

3. Persist these settings across reboots.

   CONSOLE

   Copy

   $ sudo nano /etc/sysctl.d/99-elasticsearch.conf

   Explain Code

   Powered by Vultr AgentBeta

   Add the following lines:

   INI

   Copy

   vm.max_map_count=262144

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

4. Configure JVM heap size (set to approximately 50% of available RAM, maximum 32GB).

   CONSOLE

   Copy

   $ sudo nano /etc/elasticsearch/jvm.options.d/heap.options

   Explain Code

   Powered by Vultr AgentBeta

   Add the following lines (adjust based on your server's RAM):

   INI

   Copy

   -Xms2g
   -Xmx2g

   Explain Code

   Powered by Vultr AgentBeta

   For a server with 8GB RAM, use -Xms4g and -Xmx4g. Save and close the file.

5. Restart Elasticsearch to apply all changes.

   CONSOLE

   Copy

   $ sudo systemctl restart elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

Explore Elasticsearch Features

Elasticsearch provides powerful search and analytics capabilities through its REST API. Verify your cluster is healthy before indexing data.

1. Check cluster health status.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/_cluster/health?pretty"

   Explain Code

   Powered by Vultr AgentBeta

   A green status indicates all shards are allocated. yellow is normal for single-node setups (no replicas).

2. List all indices.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/_cat/indices?v"

   Explain Code

   Powered by Vultr AgentBeta

Index and Search Data

Learn the core Elasticsearch workflow by creating an index, adding documents, and performing searches with filters and aggregations.

1. Create a new index with mapping for products.

   CONSOLE

   Copy

   $ curl -X PUT "http://localhost:9200/products" \
     -H 'Content-Type: application/json' -d'
   {
     "mappings": {
       "properties": {
         "name": { "type": "text" },
         "description": { "type": "text" },
         "price": { "type": "float" },
         "category": { "type": "keyword" }
       }
     }
   }'

   Explain Code

   Powered by Vultr AgentBeta

2. Add a sample product document.

   CONSOLE

   Copy

   $ curl -X POST "http://localhost:9200/products/_doc/1" \
     -H 'Content-Type: application/json' -d'
   {
     "name": "Laptop Pro 15",
     "description": "High-performance laptop with 16GB RAM",
     "price": 1299.99,
     "category": "Electronics"
   }'

   Explain Code

   Powered by Vultr AgentBeta

3. Search with filters and aggregations.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/products/_search?pretty" \
     -H 'Content-Type: application/json' -d'
   {
     "query": {
       "bool": {
         "must": [{ "match": { "description": "laptop" }}],
         "filter": [{ "range": { "price": { "gte": 1000 }}}]
       }
     },
     "aggs": {
       "avg_price": { "avg": { "field": "price" }}
     }
   }'

   Explain Code

   Powered by Vultr AgentBeta

Integrations and Monitoring

Extend Elasticsearch's capabilities by connecting visualization dashboards, log shippers, and alerting systems. This section demonstrates setting up Kibana for interactive exploration, plus highlights other ecosystem tools to build a complete observability stack.

Set Up Kibana for Visualization

Kibana is the official visualization platform for Elasticsearch, providing dashboards, charts, and exploration tools.

1. Install Kibana.

   CONSOLE

   Copy

   $ sudo apt install -y kibana

   Explain Code

   Powered by Vultr AgentBeta

2. Configure Kibana to connect to Elasticsearch.

   CONSOLE

   Copy

   $ sudo nano /etc/kibana/kibana.yml

   Explain Code

   Powered by Vultr AgentBeta

   Update the configuration:

   YAML

   Copy

   server.host: "0.0.0.0"
   elasticsearch.hosts: ["http://localhost:9200"]

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

3. Start and enable Kibana.

   CONSOLE

   Copy

   $ sudo systemctl start kibana
   $ sudo systemctl enable kibana

   Explain Code

   Powered by Vultr AgentBeta

4. Access Kibana at http://elastic.example.com:5601 or configure an Nginx reverse proxy with SSL similar to Elasticsearch for production use.

Additional Integration Options

Elasticsearch supports integrations with various external tools:

• Logstash: Data processing pipeline for ingesting, transforming, and enriching data before indexing.
• Beats: Lightweight data shippers for logs, metrics, and uptime monitoring (Filebeat, Metricbeat, Heartbeat).
• APM (Application Performance Monitoring): Monitor application performance and errors.
• Machine Learning: Detect anomalies and patterns in your data.
• Alerting: Set up alerts based on queries and conditions.

Configure Snapshots to Vultr Object Storage

Protect your data by configuring automated backups to Vultr Object Storage, which is S3-compatible. Use the Elasticsearch keystore to securely store credentials instead of plaintext in configuration files.

1. Create a bucket in Vultr Object Storage. Note your bucket name and access credentials.

2. Add your Vultr Object Storage credentials to the Elasticsearch keystore.

   CONSOLE

   Copy

   $ sudo /usr/share/elasticsearch/bin/elasticsearch-keystore add s3.client.default.access_key

   Explain Code

   Powered by Vultr AgentBeta

   Enter your access key when prompted.

   CONSOLE

   Copy

   $ sudo /usr/share/elasticsearch/bin/elasticsearch-keystore add s3.client.default.secret_key

   Explain Code

   Powered by Vultr AgentBeta

   Enter your secret key when prompted.

3. Restart Elasticsearch to load the keystore changes.

   CONSOLE

   Copy

   $ sudo systemctl restart elasticsearch

   Explain Code

   Powered by Vultr AgentBeta

4. Register the S3 snapshot repository.

   CONSOLE

   Copy

   $ curl -X PUT "http://localhost:9200/_snapshot/vultr_s3" \
     -H 'Content-Type: application/json' -d'
   {
     "type": "s3",
     "settings": {
       "bucket": "YOUR_BUCKET_NAME",
       "endpoint": "ewr1.vultrobjects.com",
       "protocol": "https",
       "path_style_access": true
     }
   }'

   Explain Code

   Powered by Vultr AgentBeta

   Replace YOUR_BUCKET_NAME with your bucket name and ewr1.vultrobjects.com with your region's endpoint (e.g., sjc1.vultrobjects.com for San Jose).

5. Verify the repository and create your first snapshot.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/_snapshot/vultr_s3/_all?pretty"
   
   $ curl -X PUT "http://localhost:9200/_snapshot/vultr_s3/snap-$(date +%F)?wait_for_completion=false&pretty"

   Explain Code

   Powered by Vultr AgentBeta

6. List all snapshots.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/_snapshot/vultr_s3/_all?pretty"

   Explain Code

   Powered by Vultr AgentBeta

7. Restore a snapshot.

   CONSOLE

   Copy

   $ curl -X POST "http://localhost:9200/_snapshot/vultr_s3/SNAPSHOT_NAME/_restore?pretty"

   Explain Code

   Powered by Vultr AgentBeta

Best Practices and Performance Tuning

Use these recommendations to keep your single-node deployment reliable and responsive. You will configure retention with Index Lifecycle Management (ILM), standardize defaults with index templates, monitor JVM memory usage, and enable diagnostics like slow query logs. Adjust values to match your data size and workload profile.

Index Management and Performance

1. Set up index lifecycle policies to automatically delete old indices (example: 30 days).

   CONSOLE

   Copy

   $ curl -X PUT "http://localhost:9200/_ilm/policy/retention_policy" \
     -H 'Content-Type: application/json' -d'
   {
     "policy": {
       "phases": {
         "delete": {
           "min_age": "30d",
           "actions": { "delete": {} }
         }
       }
     }
   }'

   Explain Code

   Powered by Vultr AgentBeta

2. Monitor JVM heap usage and cluster performance.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/_nodes/stats/jvm?pretty"

   Explain Code

   Powered by Vultr AgentBeta

Troubleshooting

This section covers common issues and diagnostic commands to help resolve problems with your Elasticsearch instance.

1. Verify Elasticsearch service is running and view recent logs.

   CONSOLE

   Copy

   $ sudo systemctl status elasticsearch
   $ sudo journalctl -u elasticsearch -e

   Explain Code

   Powered by Vultr AgentBeta

2. Verify cluster health.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/_cluster/health?pretty"

   Explain Code

   Powered by Vultr AgentBeta

   A green status indicates all shards are allocated. yellow means some replica shards are unallocated (normal for single-node). red indicates data loss.

3. Diagnose unallocated shards.

   CONSOLE

   Copy

   $ curl -X GET "http://localhost:9200/_cluster/allocation/explain?pretty"

   Explain Code

   Powered by Vultr AgentBeta

Use Cases

Elasticsearch excels in various real-world scenarios:

• Full-Text Search: Power website search, e-commerce product catalogs, and documentation portals with fast, relevant results.
• Centralized Log Management: Collect, parse, and analyze logs from multiple sources for troubleshooting and security monitoring.
• Operational Analytics: Track metrics, KPIs, and business data with real-time aggregations and visualizations.
• Application Performance Monitoring: Monitor application health, trace requests, and identify bottlenecks.
• Security Analytics: Detect threats, analyze intrusion patterns, and monitor security events across your infrastructure.

Conclusion

In this guide, you deployed Vultr's Elasticsearch Marketplace Application and configured it for production use. You secured the instance with firewall rules, authentication, and TLS encryption, applied OS-level tuning for optimal performance, and explored core search capabilities including indexing, querying, and aggregations. You configured role-based access control, set up snapshots to Vultr Object Storage for data protection, and integrated monitoring tools like Kibana. With these production-ready configurations, you can build scalable search applications, centralize log management, and perform real-time analytics on your data.