Over 10 years we help companies reach their financial and branding goals. Engitech is a values-driven technology agency dedicated.

Gallery

Contacts

411 University St, Seattle, USA

[email protected]

+1 -800-456-478-23

Twitter Facebook-f Pinterest-p Instagram

How to install Elasticsearch on Debian 13 with Cluster Support

This guide installs Elasticsearch on Debian 13 using Elastic's official APT repository and covers both:

Single-node Elasticsearch
Multi-node Elasticsearch cluster

For production/high-availability deployments, a common starting architecture is a 3-node cluster.

Elastic's current Debian package installation uses the official 9.x APT repository. The current documentation lists Elasticsearch 9.5.1 as the latest package at the time of writing. (Elastic)

Architecture

Example three-node cluster:

                       Applications
                           │
                           │ HTTPS :9200
                           ▼
                ┌─────────────────────┐
                │ Elasticsearch       │
                │ Cluster             │
                │                     │
                │ cluster.name:       │
                │ pkx-elasticsearch   │
                └──────────┬──────────┘
                           │
            ┌──────────────┼──────────────┐
            │              │              │
            ▼              ▼              ▼

      ┌────────────┐ ┌────────────┐ ┌────────────┐
      │   ES-01    │ │   ES-02    │ │   ES-03    │
      │            │ │            │ │            │
      │10.10.10.21 │ │10.10.10.22 │ │10.10.10.23 │
      │            │ │            │ │            │
      │ master     │ │ master     │ │ master     │
      │ data       │ │ data       │ │ data       │
      │ ingest     │ │ ingest     │ │ ingest     │
      └────────────┘ └────────────┘ └────────────┘
             │              │              │
             └──────────────┼──────────────┘
                            │
                     TCP 9300
                  Cluster Transport

Client traffic:

TCP 9200

Cluster node-to-node traffic:

TCP 9300

Recommended Cluster Size

For a production/high-availability cluster:

3 Elasticsearch nodes minimum

Elastic recommends at least three master-eligible nodes for high availability so the cluster can continue operating if one master-eligible node fails. (Elastic)

For a small cluster, all three nodes can initially perform:

master
data
ingest

For larger deployments, dedicated node roles can be introduced later.

System Requirements

Operating System

Debian 13
64-bit

Elasticsearch's Debian package can be installed on Debian-based distributions using Elastic's official repository. (Elastic)

Recommended Hardware

Small Development Node

CPU:       2 cores
RAM:       4 GB
Storage:   30 GB+

Small Production Cluster

Per node:

CPU:       4 cores+
RAM:       8-16 GB+
Storage:   100 GB+ SSD
Network:   1 Gbps+

For heavier workloads:

CPU:       8-16+ cores
RAM:       32-64 GB+
Storage:   NVMe / enterprise SSD
Network:   10 Gbps where appropriate

The actual requirement depends heavily on:

Number of documents
Indexing rate
Search rate
Shard count
Retention
Aggregations
Vector search
Replica count

Storage Recommendation

Prefer:

SSD
NVMe
Enterprise SSD

Avoid slow network storage for latency-sensitive production workloads unless the storage architecture has been validated for Elasticsearch.

The Debian package stores Elasticsearch data by default at:

/var/lib/elasticsearch

Logs:

/var/log/elasticsearch

Configuration:

/etc/elasticsearch

Certificates:

/etc/elasticsearch/certs

Elastic documents these as the standard Debian package locations. (Elastic)

Network Ports

Port Protocol Purpose
9200 TCP Elasticsearch HTTP/API
9300 TCP Elasticsearch cluster transport

For a cluster:

Application → Elasticsearch
TCP 9200

and:

Elasticsearch Node → Elasticsearch Node
TCP 9300

Port 9300 should generally only be reachable between Elasticsearch nodes.

Example Cluster

This guide uses:

Node Hostname IP
Node 1 es-01 10.10.10.21
Node 2 es-02 10.10.10.22
Node 3 es-03 10.10.10.23

Cluster:

pkx-elasticsearch

1. Configure Hostnames

On Node 1:

sudo hostnamectl set-hostname es-01

Node 2:

sudo hostnamectl set-hostname es-02

Node 3:

sudo hostnamectl set-hostname es-03

Verify:

hostnamectl

2. Configure DNS or /etc/hosts

All Elasticsearch nodes must be able to resolve each other.

If internal DNS is not available, configure:

sudo nano /etc/hosts

Add on all three nodes:

10.10.10.21 es-01
10.10.10.22 es-02
10.10.10.23 es-03

Test:

ping es-01
ping es-02
ping es-03

3. Configure vm.max_map_count

Elasticsearch uses memory-mapped files extensively.

Current Elastic guidance for Elasticsearch 8.16 and later recommends:

vm.max_map_count = 1048576

(Elastic)

Check:

sysctl vm.max_map_count

If below:

1048576

configure:

echo "vm.max_map_count=1048576" | \
    sudo tee /etc/sysctl.d/99-elasticsearch.conf

Apply:

sudo sysctl --system

Verify:

sysctl vm.max_map_count

Expected:

vm.max_map_count = 1048576

The Elasticsearch Debian package also attempts to configure required kernel parameters automatically, but keeping the setting explicitly under /etc/sysctl.d/ makes the desired server configuration clear. (Elastic)

4. Disable Swap

Elasticsearch performance can degrade heavily if JVM memory is swapped.

Check:

swapon --show

Temporarily disable:

sudo swapoff -a

To permanently disable swap, edit:

sudo nano /etc/fstab

Comment out the swap entry.

Example:

#/swapfile none swap sw 0 0

Verify:

free -h

5. Install Required Packages

Run on every Elasticsearch node:

sudo apt update

sudo apt install -y \
    wget \
    gnupg \
    apt-transport-https \
    ca-certificates

Elasticsearch includes its own supported OpenJDK, so a separate Java installation is normally unnecessary. (Elastic)

6. Add Elastic Signing Key

Run on every node:

wget -qO - \
    https://artifacts.elastic.co/GPG-KEY-elasticsearch |
    sudo gpg --dearmor \
    -o /usr/share/keyrings/elasticsearch-keyring.gpg

This is the installation method documented by Elastic for Debian packages. (Elastic)

7. Add Elasticsearch Repository

echo \
"deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/9.x/apt stable main" |
sudo tee /etc/apt/sources.list.d/elastic-9.x.list

Update:

sudo apt update

8. Install Elasticsearch

sudo apt install -y elasticsearch

Check:

/usr/share/elasticsearch/bin/elasticsearch --version

The Debian package installs Elasticsearch under:

/usr/share/elasticsearch

with configuration under:

/etc/elasticsearch

(Elastic)

Single-Node Installation

For a simple standalone Elasticsearch server, edit:

sudo nano /etc/elasticsearch/elasticsearch.yml

Example:

cluster.name: pkx-elasticsearch

node.name: es-01

network.host: 0.0.0.0

http.port: 9200

discovery.type: single-node

Then:

sudo systemctl enable --now elasticsearch

Check:

sudo systemctl status elasticsearch

Multi-Node Cluster Installation

For a new three-node cluster, configure all nodes with the same:

cluster.name
discovery.seed_hosts
cluster.initial_master_nodes

but a unique:

node.name
network.host

Node 1 Configuration

Edit:

sudo nano /etc/elasticsearch/elasticsearch.yml

Configure:

cluster.name: pkx-elasticsearch

node.name: es-01

network.host: 10.10.10.21

http.port: 9200
transport.port: 9300

node.roles:
  - master
  - data
  - ingest

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

Node 2 Configuration

cluster.name: pkx-elasticsearch

node.name: es-02

network.host: 10.10.10.22

http.port: 9200
transport.port: 9300

node.roles:
  - master
  - data
  - ingest

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

Node 3 Configuration

cluster.name: pkx-elasticsearch

node.name: es-03

network.host: 10.10.10.23

http.port: 9200
transport.port: 9300

node.roles:
  - master
  - data
  - ingest

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

discovery.seed_hosts tells Elasticsearch how to discover master-eligible nodes. (Elastic)

Important: cluster.initial_master_nodes

This setting is used only when bootstrapping a brand-new cluster:

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

Once the cluster has successfully formed, remove this setting from every node and never configure it again for that cluster. Elastic explicitly warns not to use it for nodes joining an existing cluster or during normal restarts. (Elastic)

After initial cluster formation, configuration should therefore become:

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

without:

cluster.initial_master_nodes:

Security

Modern Elasticsearch enables security automatically during initial configuration.

Elastic's security auto-configuration creates:

TLS for HTTP
TLS for transport
elastic superuser
Certificate Authority
Enrollment support

(Elastic)

Generated certificates are stored under:

/etc/elasticsearch/certs/

Recommended Method for Adding Cluster Nodes

For current Elasticsearch packages, Elastic supports enrolling additional nodes into an existing secure cluster.

On an existing node:

sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token \
    -s node

This generates a temporary node enrollment token. (Elastic)

Example:

eyJ2ZXIiOiI4Lj...

Reconfigure New Debian Node

On the new node:

sudo /usr/share/elasticsearch/bin/elasticsearch-reconfigure-node \
    --enrollment-token <TOKEN>

Elastic specifically provides elasticsearch-reconfigure-node for configuring a newly installed Debian/RPM node to join an existing secure cluster. (Elastic)

Then:

sudo systemctl start elasticsearch

Start Elasticsearch

On all nodes:

sudo systemctl daemon-reload

sudo systemctl enable elasticsearch

Start Node 1:

sudo systemctl start elasticsearch

Then Node 2:

sudo systemctl start elasticsearch

Then Node 3:

sudo systemctl start elasticsearch

Check:

sudo systemctl status elasticsearch

Check Logs

sudo journalctl -u elasticsearch

Follow:

sudo journalctl -u elasticsearch -f

Elasticsearch logs are also available at:

/var/log/elasticsearch/

Reset elastic Password

If needed:

sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password \
    -u elastic

Interactive:

sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password \
    -i \
    -u elastic

Save this password securely.

Test Elasticsearch

Because HTTPS is enabled by default, use the generated CA.

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200

Enter the elastic password.

Expected output contains information such as:

{
  "name": "es-01",
  "cluster_name": "pkx-elasticsearch",
  "version": {
    "number": "9.x.x"
  }
}

Check Cluster Health

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cluster/health?pretty

Expected for a healthy cluster:

{
  "cluster_name": "pkx-elasticsearch",
  "status": "green",
  "number_of_nodes": 3,
  "number_of_data_nodes": 3
}

Check Cluster Nodes

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/nodes?v

Example:

ip           name    node.role   master
10.10.10.21  es-01   dim        *
10.10.10.22  es-02   dim        -
10.10.10.23  es-03   dim        -

The * indicates the currently elected master.

Check Master

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/master?v

Check Shards

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/shards?v

Check Indices

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/indices?v

Firewall Configuration

Assuming the Elasticsearch network is:

10.10.10.0/24

allow cluster traffic:

sudo ufw allow \
    from 10.10.10.0/24 \
    to any port 9300 \
    proto tcp

Allow API access from application servers only.

For example:

Application Server:
10.10.10.50

Configure:

sudo ufw allow \
    from 10.10.10.50 \
    to any port 9200 \
    proto tcp

Do not expose:

9300

to the public Internet.

Prefer not to expose:

9200

publicly either.

Recommended Network Design

Internet
    │
    X
    │
    │ No direct Elasticsearch access
    │
Application Network
    │
    │ HTTPS 9200
    ▼
┌───────────────────────────────┐
│ Elasticsearch Cluster        │
│                               │
│ ES-01 ↔ ES-02 ↔ ES-03         │
│         TCP 9300              │
└───────────────────────────────┘

Memory / JVM Heap

Modern Elasticsearch automatically calculates an appropriate JVM heap based on:

Available memory
Node roles
Workload

Elastic recommends relying on automatic JVM sizing unless there is a specific reason to override it. (Elastic)

Therefore, for most installations:

Do not manually configure Xms/Xmx initially.

Manual Heap Configuration

If manual configuration is required, create:

sudo nano /etc/elasticsearch/jvm.options.d/heap.options

Example for an 8 GB heap:

-Xms8g
-Xmx8g

Always keep:

Xms = Xmx

Elastic's bootstrap checks specifically warn about different initial and maximum JVM heap sizes. (Elastic)

Do not allocate all server RAM to Java.

Elasticsearch needs significant off-heap memory for:

Filesystem cache
Lucene
Memory-mapped index files
Native libraries
Networking

Node Roles

Elasticsearch supports specialized node roles.

Common roles include:

master
data
ingest
ml
transform
remote_cluster_client

Elastic requires every cluster to have appropriate master and data roles available. (Elastic)

Small Cluster Recommendation

For three relatively small servers:

node.roles:
  - master
  - data
  - ingest

on all three nodes is simple and resilient.

Architecture:

ES-01
master + data + ingest

ES-02
master + data + ingest

ES-03
master + data + ingest

Larger Production Cluster

For larger workloads:

3 Dedicated Master Nodes

          +

3+ Data Nodes

          +

2+ Ingest Nodes

          +

Optional Coordinating Nodes

Example:

               Clients
                  │
                  ▼
        ┌──────────────────┐
        │ Coordinating     │
        │ Nodes            │
        └────────┬─────────┘
                 │
        ┌────────┴─────────┐
        │                  │
        ▼                  ▼
    Data Nodes         Ingest Nodes
        │
        └───────┬──────────┘
                │
                ▼
          Master Nodes
          ┌────┬────┐
          │ M1 │ M2 │ M3
          └────┴────┘

Dedicated Master Node

Example:

node.roles:
  - master

Dedicated master nodes should not receive ordinary client traffic.

Elastic's HA guidance requires at least three master-eligible nodes, with at least two capable of becoming elected master. (Elastic)

Dedicated Data Node

Example:

node.roles:
  - data
  - ingest

Coordinating-Only Node

node.roles: []

A node with an empty roles list becomes a coordinating-only node. (Elastic)

Applications can connect to these nodes instead of connecting directly to master nodes.

Replicas

For production indexes, use at least one replica:

{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1
  }
}

Architecture:

Primary shard
     │
     ├── ES-01
     │
Replica shard
     │
     └── ES-02

Elastic's resilience guidance recommends at least two copies of each shard for HA workloads. (Elastic)

Create Test Index

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    -X PUT \
    https://localhost:9200/test-index

Insert Test Document

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    -H "Content-Type: application/json" \
    -X POST \
    https://localhost:9200/test-index/_doc \
    -d '{
      "name": "Elasticsearch Cluster Test",
      "status": "working"
    }'

Search Test Index

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/test-index/_search?pretty

Application Connection

Applications should preferably know about multiple nodes.

Example:

https://es-01:9200
https://es-02:9200
https://es-03:9200

Rather than relying solely on:

https://es-01:9200

Load Balancer

Another option is:

Application
     │
     ▼
Load Balancer
     │
     ├── ES-01:9200
     ├── ES-02:9200
     └── ES-03:9200

For example:

https://elasticsearch.internal.example.com

This can simplify application configuration.

ASP.NET Core Example

For the modern Elastic .NET client, the application can be configured with multiple nodes.

Conceptually:

ES Nodes:
10.10.10.21:9200
10.10.10.22:9200
10.10.10.23:9200

Use the exact APIs supported by the version of the official Elastic .NET client your application uses.

Adding Another Node

Suppose:

ES-04
10.10.10.24

Install Elasticsearch normally.

On an existing cluster node:

sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token \
    -s node

On ES-04:

sudo /usr/share/elasticsearch/bin/elasticsearch-reconfigure-node \
    --enrollment-token <TOKEN>

Then:

sudo systemctl enable --now elasticsearch

Check:

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/nodes?v

Removing Nodes

Do not arbitrarily stop multiple master-eligible nodes simultaneously.

Elastic uses quorum-based cluster elections, so stopping half or more voting master-eligible nodes can make the cluster unavailable. (Elastic)

With three master-eligible nodes:

3 running
↓
1 may fail
↓
2 remain
↓
Cluster still has majority

But:

3 running
↓
2 stopped
↓
1 remains
↓
No majority
↓
Cluster unavailable

For maintenance, remove/restart nodes one at a time.

Backup

Elasticsearch backups should use the Snapshot and Restore API.

Do not treat copying:

/var/lib/elasticsearch

while Elasticsearch is running as a valid backup strategy.

Elastic requires registering an external snapshot repository before snapshots can be created. (Elastic)

Supported repository options include mechanisms such as:

Shared filesystem
S3
Azure
GCS

depending on deployment and installed repository support.

Shared Filesystem Snapshot Example

On all nodes, mount the same storage location:

/mnt/elasticsearch-backup

Configure:

path.repo:
  - /mnt/elasticsearch-backup

Restart Elasticsearch.

Then register the repository through the API.

Elastic documents shared filesystem repositories for self-managed clusters. (Elastic)

S3 Backup

Elasticsearch supports an S3 repository for Snapshot/Restore. (Elastic)

Typical architecture:

Elasticsearch Cluster
        │
        │ Snapshot
        ▼
    S3 Bucket

This is useful when Elasticsearch is running in:

AWS
On-premises
Private cloud
Hybrid infrastructure

Elasticsearch Service Commands

Start:

sudo systemctl start elasticsearch

Stop:

sudo systemctl stop elasticsearch

Restart:

sudo systemctl restart elasticsearch

Enable:

sudo systemctl enable elasticsearch

Status:

sudo systemctl status elasticsearch

Useful API Commands

Health

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cluster/health?pretty

Nodes

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/nodes?v

Indices

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/indices?v

Shards

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/shards?v

Cluster State

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cluster/state?pretty

Troubleshooting

Elasticsearch Does Not Start

Check:

sudo systemctl status elasticsearch

Logs:

sudo journalctl -u elasticsearch -n 200

Also:

sudo tail -f \
    /var/log/elasticsearch/pkx-elasticsearch.log

Bootstrap Check Failure

Once Elasticsearch is bound to a non-loopback interface, production bootstrap checks become important.

Typical problems include:

vm.max_map_count too low
file descriptor limit too low
thread limit too low
memory locking problems
virtual memory limits

Elastic enforces these production checks to prevent unsafe Elasticsearch configurations. (Elastic)

Check vm.max_map_count

sysctl vm.max_map_count

Recommended current value:

1048576

Check Port 9200

sudo ss -lntp | grep 9200

Check Port 9300

sudo ss -lntp | grep 9300

Test Node-to-Node Connectivity

From ES-01:

nc -vz es-02 9300
nc -vz es-03 9300

From ES-02:

nc -vz es-01 9300
nc -vz es-03 9300

Cluster Does Not Form

Check that every node has exactly the same:

cluster.name: pkx-elasticsearch

Verify:

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

Verify:

DNS resolution
TCP 9300
TLS transport certificates
Node names
Cluster name
Firewall

Nodes Form Separate Clusters

If each server accidentally created its own independent cluster, do not attempt to merge their data directories manually.

Stop and determine which cluster contains the correct data.

cluster.initial_master_nodes must only be used during the first bootstrap of the intended cluster. Incorrect reuse of this setting can form a separate cluster. (Elastic)

Recommended Production Layout

For a normal three-node environment:

                    Applications
                         │
                         ▼
               Load Balancer / DNS
                         │
                  HTTPS :9200
                         │
         ┌───────────────┼───────────────┐
         │               │               │
         ▼               ▼               ▼
      ES-01           ES-02           ES-03
   10.10.10.21     10.10.10.22     10.10.10.23

   master           master           master
   data             data             data
   ingest           ingest           ingest

         │               │               │
         └───────────────┼───────────────┘
                         │
                     TCP 9300

Every node:

cluster.name: pkx-elasticsearch

node.roles:
  - master
  - data
  - ingest

Recommended Production Checklist

  • [ ] Use at least three master-eligible nodes for HA.
  • [ ] Give every node a unique node.name.
  • [ ] Keep the same cluster.name across the cluster.
  • [ ] Configure discovery.seed_hosts.
  • [ ] Use cluster.initial_master_nodes only for initial bootstrap.
  • [ ] Remove cluster.initial_master_nodes after the cluster forms.
  • [ ] Keep TCP 9300 private between cluster nodes.
  • [ ] Restrict TCP 9200 to trusted applications/networks.
  • [ ] Keep Elasticsearch TLS/security enabled.
  • [ ] Do not expose Elasticsearch directly to the public Internet.
  • [ ] Set vm.max_map_count=1048576.
  • [ ] Avoid swap on production Elasticsearch nodes.
  • [ ] Prefer SSD/NVMe storage.
  • [ ] Keep enough RAM available for filesystem cache.
  • [ ] Use automatic JVM heap sizing unless there is a specific reason not to.
  • [ ] Configure at least one replica for important production indices.
  • [ ] Use Snapshot/Restore for backups.
  • [ ] Monitor disk utilization.
  • [ ] Monitor shard count and cluster health.
  • [ ] Restart or remove master-eligible nodes one at a time.
  • [ ] Follow Elastic's rolling upgrade procedure when upgrading.

Quick Install — Every Node

sudo apt update

sudo apt install -y \
    wget \
    gnupg \
    apt-transport-https \
    ca-certificates

wget -qO - \
    https://artifacts.elastic.co/GPG-KEY-elasticsearch |
    sudo gpg --dearmor \
    -o /usr/share/keyrings/elasticsearch-keyring.gpg

echo \
"deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/9.x/apt stable main" |
sudo tee /etc/apt/sources.list.d/elastic-9.x.list

sudo apt update
sudo apt install -y elasticsearch

Configure kernel:

echo "vm.max_map_count=1048576" |
sudo tee /etc/sysctl.d/99-elasticsearch.conf

sudo sysctl --system

Quick Three-Node Configuration

ES-01

cluster.name: pkx-elasticsearch

node.name: es-01

network.host: 10.10.10.21

http.port: 9200
transport.port: 9300

node.roles:
  - master
  - data
  - ingest

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

ES-02

cluster.name: pkx-elasticsearch

node.name: es-02

network.host: 10.10.10.22

http.port: 9200
transport.port: 9300

node.roles:
  - master
  - data
  - ingest

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

ES-03

cluster.name: pkx-elasticsearch

node.name: es-03

network.host: 10.10.10.23

http.port: 9200
transport.port: 9300

node.roles:
  - master
  - data
  - ingest

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

Start all nodes:

sudo systemctl enable --now elasticsearch

Verify:

curl \
    --cacert /etc/elasticsearch/certs/http_ca.crt \
    -u elastic \
    https://localhost:9200/_cat/nodes?v

After all three nodes form the intended cluster, remove:

cluster.initial_master_nodes:
  - es-01
  - es-02
  - es-03

from all three configuration files.

Keep:

discovery.seed_hosts:
  - es-01
  - es-02
  - es-03

References

Elastic's official Debian installation documentation describes installing Elasticsearch from the signed 9.x APT repository, the bundled JDK, Debian filesystem locations, automatic security configuration, and the node enrollment process. (Elastic)

Elastic's cluster discovery documentation defines discovery.seed_hosts and requires cluster.initial_master_nodes only during initial cluster bootstrap; that setting must be removed after the cluster successfully forms. (Elastic)

For high availability, Elastic recommends at least three master-eligible nodes so that the cluster can tolerate the loss of one node and retain a voting majority. (Elastic)

For current Elasticsearch releases, Elastic recommends vm.max_map_count=1048576; Debian packages attempt to configure kernel requirements automatically, but explicit host configuration is appropriate for production systems. (Elastic)

Elastic recommends its Snapshot and Restore mechanism for cluster backups rather than filesystem-level copies of live Elasticsearch data. (Elastic)

Leave a comment

Your email address will not be published. Required fields are marked *