Elasticsearch

Access Elasticsearch API

• URL: http://<server-ip>:9200
• Internal cluster communication: 127.0.0.1:9300 (do not expose externally)

Credentials

• User: elastic
• Password: stored securely in /root/.cloudzy-creds

Important Directories

• Config: /etc/elasticsearch
• Data: /var/lib/elasticsearch
• Logs: /var/log/elasticsearch
• Binaries: /usr/share/elasticsearch/bin
• Plugins: /usr/share/elasticsearch/plugins

Managing the Service

Use systemctl commands:

systemctl status elasticsearch
systemctl restart elasticsearch
systemctl stop elasticsearch
systemctl start elasticsearch

Enrolling Kibana (Optional)

If you plan to install Kibana separately, you need to generate an enrollment token on Elasticsearch and use it to configure Kibana securely.

1. Generate enrollment token on Elasticsearch server:

/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

2. Copy the generated token and on the Kibana server run:

/usr/share/kibana/bin/kibana-setup --enrollment-token "<your-token>"

This enrolls Kibana with Elasticsearch securely.

Example Elasticsearch Commands

Check cluster health:

curl -X GET -k "https://localhost:9200/_cluster/health?pretty" 
  -u elastic:<password> 
  --cacert /etc/elasticsearch/certs/http_ca.crt

List all indices:

curl -X GET -k "https://localhost:9200/_cat/indices?v" 
  -u elastic:<password> 
  --cacert /etc/elasticsearch/certs/http_ca.crt