How to Install and Configure Elasticsearch on a Linux VPS: Complete Guide

Elasticsearch is one of the most widely used open-source search and analytics engines in the world. Whether you're running a high-traffic website, an e-commerce platform, a log analysis system, or any application that requires fast, flexible full-text search, Elasticsearch is the go-to solution. In this guide, you'll learn how to install, configure, and secure Elasticsearch on a NVMe VPS or SSD VPS running Ubuntu 22.04.

What Is Elasticsearch and Why Use It?

Elasticsearch is built on top of the Apache Lucene library and provides:

Full-text search with relevance ranking and advanced filtering
Real-time analytics on structured and unstructured data
Horizontal scalability through clustering and sharding
REST API for easy integration with any programming language
ELK stack (Elasticsearch + Logstash + Kibana) for monitoring and visualization

For reliable production use, Elasticsearch requires at least 2 GB of RAM and 2 vCPUs. We recommend a NVMe VPS for maximum performance during heavy indexing operations.

Prerequisites

Before you begin, make sure you have:

A VPS running Ubuntu 22.04 (or Debian 11/12)
Root access or a user with sudo privileges
Java 17+ (Elasticsearch 8.x ships with a bundled OpenJDK)
Ports 9200 (HTTP) and 9300 (transport) available
A configured firewall (UFW or iptables)

Step 1: Update the System

Always start with a full package update:

sudo apt update && sudo apt upgrade -y

Step 2: Add the Official Elasticsearch Repository

Elasticsearch is not available in the default Ubuntu repositories. Add the official Elastic source:

# Import GPG key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

# Add the 8.x repository
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

# Update package list
sudo apt update

Step 3: Install Elasticsearch

sudo apt install elasticsearch -y

After installation, the terminal will display a temporary password for the elastic superuser — save it immediately!

The generated password for the elastic built-in superuser is:
XXXXXXXXXXXXXXXXXXX

Step 4: Configure elasticsearch.yml

The main configuration file is located at /etc/elasticsearch/elasticsearch.yml. Open it with a text editor:

sudo nano /etc/elasticsearch/elasticsearch.yml

Modify or verify these essential settings:

# Cluster name (unique on the network)
cluster.name: my-cluster

# Node name
node.name: node-1

# Data storage directory
path.data: /var/lib/elasticsearch

# Log directory
path.logs: /var/log/elasticsearch

# Listening address (127.0.0.1 for local use; 0.0.0.0 for network)
network.host: 127.0.0.1

# HTTP port
http.port: 9200

# Single-node discovery (for standalone VPS)
discovery.type: single-node

# Enable X-Pack security
xpack.security.enabled: true

Tip: If Elasticsearch is only used by applications on the same server, keep network.host: 127.0.0.1 for maximum security.

Step 5: Configure JVM Memory

Elasticsearch relies heavily on Java heap memory. Adjust the limits based on available RAM:

sudo nano /etc/elasticsearch/jvm.options.d/jvm-custom.options

Add (for a 4 GB RAM VPS, allocate 2 GB to Elasticsearch):

-Xms2g
-Xmx2g

Golden rule: never allocate more than 50% of total RAM and never exceed 32 GB.

Step 6: Tune System Limits

Elasticsearch requires specific Linux kernel adjustments:

# Increase file descriptor limits
sudo sh -c 'echo "elasticsearch soft nofile 65536" >> /etc/security/limits.conf'
sudo sh -c 'echo "elasticsearch hard nofile 65536" >> /etc/security/limits.conf'

# Set vm.max_map_count (required by Elasticsearch)
sudo sysctl -w vm.max_map_count=262144

# Make the setting persistent
echo 'vm.max_map_count=262144' | sudo tee -a /etc/sysctl.conf

Step 7: Start and Enable the Service

sudo systemctl daemon-reload
sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch

Check the service status:

sudo systemctl status elasticsearch

You should see Active: active (running).

Step 8: Test the Installation

Verify that Elasticsearch is responding correctly:

curl -k -u elastic:YOUR_PASSWORD https://localhost:9200

A successful response looks like this:

{
  "name" : "node-1",
  "cluster_name" : "my-cluster",
  "version" : {
    "number" : "8.x.x",
    "lucene_version" : "9.x.x"
  },
  "tagline" : "You Know, for Search"
}

Step 9: Reset Password and Manage Users

If you've lost the initial password, reset it with:

sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

To create a new user with limited permissions:

sudo /usr/share/elasticsearch/bin/elasticsearch-users useradd myuser -p mypassword -r viewer

Step 10: Secure Access with a Firewall

If you haven't already secured your Linux VPS with a firewall, block external access to port 9200:

# Block external access
sudo ufw deny 9200
sudo ufw deny 9300
sudo ufw allow ssh
sudo ufw enable

If you need access from another server (e.g., a separate application server), allow only that specific IP:

sudo ufw allow from 1.2.3.4 to any port 9200

For advanced security hardening, consider CLIQHOST's server management services, where our engineers handle configuration, monitoring, and updates.

Basic Operations with the REST API

Once running, you can interact with Elasticsearch via HTTP requests:

Create an Index

curl -k -u elastic:PASSWORD -X PUT "https://localhost:9200/products?pretty"

Add a Document

curl -k -u elastic:PASSWORD -X POST "https://localhost:9200/products/_doc/1?pretty" \
-H 'Content-Type: application/json' \
-d '{
  "name": "Asus Laptop",
  "price": 3500,
  "category": "electronics"
}'

Simple Search

curl -k -u elastic:PASSWORD -X GET "https://localhost:9200/products/_search?q=Laptop&pretty"

Advanced Search (Query DSL)

curl -k -u elastic:PASSWORD -X GET "https://localhost:9200/products/_search?pretty" \
-H 'Content-Type: application/json' \
-d '{
  "query": {
    "range": {
      "price": { "gte": 1000, "lte": 5000 }
    }
  }
}'

Production Optimization Best Practices

For a stable production deployment on a dedicated server or VPS, follow these best practices:

Regular snapshots — set up automated index backups to S3 or local storage
Index Lifecycle Management (ILM) — automatically archive or delete old indices
Monitoring — integrate with Kibana or external monitoring tools
Replica shards — configure at least one replica shard for redundancy
Slow log — enable slow query logging for performance diagnostics

# Add to elasticsearch.yml
index.search.slowlog.threshold.query.warn: 10s
index.search.slowlog.threshold.fetch.warn: 1s

Managing Elasticsearch Logs

Logs are stored in /var/log/elasticsearch/. Monitor errors in real time:

sudo tail -f /var/log/elasticsearch/my-cluster.log

For more Linux server administration tips, visit the CLIQHOST blog.

Conclusion

Elasticsearch is a powerful tool, but it requires careful resource planning and security configuration. By following the steps in this guide, you'll have a fully functional, secured, and optimized Elasticsearch installation on your Linux VPS. The key to success is proper memory allocation, locked-down network access, and continuous monitoring.

If you need high-performance, reliable infrastructure for Elasticsearch, explore CLIQHOST's NVMe VPS plans — fast NVMe storage, dedicated resources, and expert support. For larger projects, managed dedicated servers deliver the raw compute power and hands-on assistance you need. Contact us to find the perfect fit for your workload.

How to Install and Configure Elasticsearch on a Linux VPS: Complete Guide