- Elasticsearch Guide: other versions:
- Getting Started
- Set up Elasticsearch
- Installing Elasticsearch
- Configuring Elasticsearch
- Important Elasticsearch configuration
- Important System Configuration
- Bootstrap Checks
- Heap size check
- File descriptor check
- Memory lock check
- Maximum number of threads check
- Maximum size virtual memory check
- Max file size check
- Maximum map count check
- Client JVM check
- Use serial collector check
- System call filter check
- OnError and OnOutOfMemoryError checks
- Early-access check
- G1GC check
- Stopping Elasticsearch
- Upgrade Elasticsearch
- Set up X-Pack
- Breaking changes
- Breaking changes in 6.0
- Aggregations changes
- Analysis changes
- Cat API changes
- Clients changes
- Cluster changes
- Document API changes
- Indices changes
- Ingest changes
- Java API changes
- Mapping changes
- Packaging changes
- Percolator changes
- Plugins changes
- Reindex changes
- REST changes
- Scripting changes
- Search and Query DSL changes
- Settings changes
- Stats and info changes
- Breaking changes in 6.1
- Breaking changes in 6.0
- X-Pack Breaking Changes
- API Conventions
- Document APIs
- Search APIs
- Aggregations
- Metrics Aggregations
- Avg Aggregation
- Cardinality Aggregation
- Extended Stats Aggregation
- Geo Bounds Aggregation
- Geo Centroid Aggregation
- Max Aggregation
- Min Aggregation
- Percentiles Aggregation
- Percentile Ranks Aggregation
- Scripted Metric Aggregation
- Stats Aggregation
- Sum Aggregation
- Top Hits Aggregation
- Value Count Aggregation
- Bucket Aggregations
- Adjacency Matrix Aggregation
- Children Aggregation
- Composite Aggregation
- Date Histogram Aggregation
- Date Range Aggregation
- Diversified Sampler Aggregation
- Filter Aggregation
- Filters Aggregation
- Geo Distance Aggregation
- GeoHash grid Aggregation
- Global Aggregation
- Histogram Aggregation
- IP Range Aggregation
- Missing Aggregation
- Nested Aggregation
- Range Aggregation
- Reverse nested Aggregation
- Sampler Aggregation
- Significant Terms Aggregation
- Significant Text Aggregation
- Terms Aggregation
- Pipeline Aggregations
- Avg Bucket Aggregation
- Derivative Aggregation
- Max Bucket Aggregation
- Min Bucket Aggregation
- Sum Bucket Aggregation
- Stats Bucket Aggregation
- Extended Stats Bucket Aggregation
- Percentiles Bucket Aggregation
- Moving Average Aggregation
- Cumulative Sum Aggregation
- Bucket Script Aggregation
- Bucket Selector Aggregation
- Bucket Sort Aggregation
- Serial Differencing Aggregation
- Matrix Aggregations
- Caching heavy aggregations
- Returning only aggregation results
- Aggregation Metadata
- Returning the type of the aggregation
- Metrics Aggregations
- Indices APIs
- Create Index
- Delete Index
- Get Index
- Indices Exists
- Open / Close Index API
- Shrink Index
- Split Index
- Rollover Index
- Put Mapping
- Get Mapping
- Get Field Mapping
- Types Exists
- Index Aliases
- Update Indices Settings
- Get Settings
- Analyze
- Index Templates
- Indices Stats
- Indices Segments
- Indices Recovery
- Indices Shard Stores
- Clear Cache
- Flush
- Refresh
- Force Merge
- cat APIs
- Cluster APIs
- Query DSL
- Mapping
- Analysis
- Anatomy of an analyzer
- Testing analyzers
- Analyzers
- Normalizers
- Tokenizers
- Token Filters
- Standard Token Filter
- ASCII Folding Token Filter
- Flatten Graph Token Filter
- Length Token Filter
- Lowercase Token Filter
- Uppercase Token Filter
- NGram Token Filter
- Edge NGram Token Filter
- Porter Stem Token Filter
- Shingle Token Filter
- Stop Token Filter
- Word Delimiter Token Filter
- Word Delimiter Graph Token Filter
- Stemmer Token Filter
- Stemmer Override Token Filter
- Keyword Marker Token Filter
- Keyword Repeat Token Filter
- KStem Token Filter
- Snowball Token Filter
- Phonetic Token Filter
- Synonym Token Filter
- Synonym Graph Token Filter
- Compound Word Token Filters
- Reverse Token Filter
- Elision Token Filter
- Truncate Token Filter
- Unique Token Filter
- Pattern Capture Token Filter
- Pattern Replace Token Filter
- Trim Token Filter
- Limit Token Count Token Filter
- Hunspell Token Filter
- Common Grams Token Filter
- Normalization Token Filter
- CJK Width Token Filter
- CJK Bigram Token Filter
- Delimited Payload Token Filter
- Keep Words Token Filter
- Keep Types Token Filter
- Classic Token Filter
- Apostrophe Token Filter
- Decimal Digit Token Filter
- Fingerprint Token Filter
- Minhash Token Filter
- Character Filters
- Modules
- Index Modules
- Ingest Node
- Pipeline Definition
- Ingest APIs
- Accessing Data in Pipelines
- Handling Failures in Pipelines
- Processors
- Append Processor
- Convert Processor
- Date Processor
- Date Index Name Processor
- Fail Processor
- Foreach Processor
- Grok Processor
- Gsub Processor
- Join Processor
- JSON Processor
- KV Processor
- Lowercase Processor
- Remove Processor
- Rename Processor
- Script Processor
- Set Processor
- Split Processor
- Sort Processor
- Trim Processor
- Uppercase Processor
- Dot Expander Processor
- URL Decode Processor
- Monitoring Elasticsearch
- X-Pack APIs
- Info API
- Explore API
- Machine Learning APIs
- Close Jobs
- Create Datafeeds
- Create Jobs
- Delete Datafeeds
- Delete Jobs
- Delete Model Snapshots
- Flush Jobs
- Forecast Jobs
- Get Buckets
- Get Overall Buckets
- Get Categories
- Get Datafeeds
- Get Datafeed Statistics
- Get Influencers
- Get Jobs
- Get Job Statistics
- Get Model Snapshots
- Get Records
- Open Jobs
- Post Data to Jobs
- Preview Datafeeds
- Revert Model Snapshots
- Start Datafeeds
- Stop Datafeeds
- Update Datafeeds
- Update Jobs
- Update Model Snapshots
- Security APIs
- Watcher APIs
- Migration APIs
- Deprecation Info APIs
- Definitions
- X-Pack Commands
- How To
- Testing
- Glossary of terms
- Release Notes
- 6.1.4 Release Notes
- 6.1.3 Release Notes
- 6.1.2 Release Notes
- 6.1.1 Release Notes
- 6.1.0 Release Notes
- 6.0.1 Release Notes
- 6.0.0 Release Notes
- 6.0.0-rc2 Release Notes
- 6.0.0-rc1 Release Notes
- 6.0.0-beta2 Release Notes
- 6.0.0-beta1 Release Notes
- 6.0.0-alpha2 Release Notes
- 6.0.0-alpha1 Release Notes
- 6.0.0-alpha1 Release Notes (Changes previously released in 5.x)
- X-Pack Release Notes
WARNING: Version 6.1 of Elasticsearch has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Install Elasticsearch with Debian Package
editInstall Elasticsearch with Debian Package
editThe Debian package for Elasticsearch can be downloaded from our website or from our APT repository. It can be used to install Elasticsearch on any Debian-based system such as Debian and Ubuntu.
The latest stable version of Elasticsearch can be found on the Download Elasticsearch page. Other versions can be found on the Past Releases page.
Elasticsearch requires Java 8. Use the official Oracle distribution or an open-source distribution such as OpenJDK.
Import the Elasticsearch PGP Key
editWe sign all of our packages with the Elasticsearch Signing Key (PGP key D88E42B4, available from https://pgp.mit.edu) with fingerprint:
4609 5ACC 8548 582C 1A26 99A9 D27D 666C D88E 42B4
Download and install the public signing key:
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
Installing from the APT repository
editYou may need to install the apt-transport-https
package on Debian before proceeding:
sudo apt-get install apt-transport-https
Save the repository definition to /etc/apt/sources.list.d/elastic-6.x.list
:
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list
These instructions do not use add-apt-repository
for several reasons:
-
add-apt-repository
adds entries to the system/etc/apt/sources.list
file rather than a clean per-repository file in/etc/apt/sources.list.d
-
add-apt-repository
is not part of the default install on many distributions and requires a number of non-default dependencies. -
Older versions of
add-apt-repository
always add adeb-src
entry which will cause errors because we do not provide a source package. If you have added thedeb-src
entry, you will see an error like the following until you delete thedeb-src
line:Unable to find expected entry 'main/source/Sources' in Release file (Wrong sources.list entry or malformed file)
You can install the Elasticsearch Debian package with:
sudo apt-get update && sudo apt-get install elasticsearch
If two entries exist for the same Elasticsearch repository, you will see an error like this during apt-get update
:
Duplicate sources.list entry https://artifacts.elastic.co/packages/6.x/apt/ ...`
Examine /etc/apt/sources.list.d/elasticsearch-6.x.list
for the duplicate entry or locate the duplicate entry amongst the files in /etc/apt/sources.list.d/
and the /etc/apt/sources.list
file.
On systemd-based distributions, the installation scripts will attempt to set kernel parameters (e.g.,
vm.max_map_count
); you can skip this by masking the systemd-sysctl.service unit.
Download and install the Debian package manually
editThe Debian package for Elasticsearch v6.1.4 can be downloaded from the website and installed as follows:
SysV init
vs systemd
editElasticsearch is not started automatically after installation. How to start
and stop Elasticsearch depends on whether your system uses SysV init
or
systemd
(used by newer distributions). You can tell which is being used by
running this command:
ps -p 1
Running Elasticsearch with SysV init
editUse the update-rc.d
command to configure Elasticsearch to start automatically
when the system boots up:
sudo update-rc.d elasticsearch defaults 95 10
Elasticsearch can be started and stopped using the service
command:
sudo -i service elasticsearch start sudo -i service elasticsearch stop
If Elasticsearch fails to start for any reason, it will print the reason for
failure to STDOUT. Log files can be found in /var/log/elasticsearch/
.
Running Elasticsearch with systemd
editTo configure Elasticsearch to start automatically when the system boots up, run the following commands:
sudo /bin/systemctl daemon-reload sudo /bin/systemctl enable elasticsearch.service
Elasticsearch can be started and stopped as follows:
sudo systemctl start elasticsearch.service sudo systemctl stop elasticsearch.service
These commands provide no feedback as to whether Elasticsearch was started
successfully or not. Instead, this information will be written in the log
files located in /var/log/elasticsearch/
.
By default the Elasticsearch service doesn’t log information in the systemd
journal. To enable journalctl
logging, the --quiet
option must be removed
from the ExecStart
command line in the elasticsearch.service
file.
When systemd
logging is enabled, the logging information are available using
the journalctl
commands:
To tail the journal:
sudo journalctl -f
To list journal entries for the elasticsearch service:
sudo journalctl --unit elasticsearch
To list journal entries for the elasticsearch service starting from a given time:
sudo journalctl --unit elasticsearch --since "2016-10-30 18:17:16"
Check man journalctl
or https://www.freedesktop.org/software/systemd/man/journalctl.html for
more command line options.
Checking that Elasticsearch is running
editYou can test that your Elasticsearch node is running by sending an HTTP
request to port 9200
on localhost
:
GET /
which should give you a response something like this:
{ "name" : "Cp8oag6", "cluster_name" : "elasticsearch", "cluster_uuid" : "AT69_T_DTp-1qgIJlatQqA", "version" : { "number" : "6.1.4", "build_hash" : "f27399d", "build_date" : "2016-03-30T09:51:41.449Z", "build_snapshot" : false, "lucene_version" : "7.1.0", "minimum_wire_compatibility_version" : "1.2.3", "minimum_index_compatibility_version" : "1.2.3" }, "tagline" : "You Know, for Search" }
Configuring Elasticsearch
editElasticsearch defaults to using /etc/elasticsearch
for runtime configuration.
The ownership of this directory and all files in this directory are set to
root:elasticsearch
on package installation and the directory has the setgid
flag set so that any files and subdirectories created under /etc/elasticsearch
are created with this ownership as well (e.g., if a keystore is created using
the keystore tool). It is expected that this be maintained so
that the Elasticsearch process can read the files under this directory via the
group permissions.
Elasticsearch loads its configuration from the
/etc/elasticsearch/elasticsearch.yml
file by default. The format of this
config file is explained in Configuring Elasticsearch.
The Debian package also has a system configuration file (/etc/default/elasticsearch
),
which allows you to set the following parameters:
|
Set a custom Java path to be used. |
|
Maximum number of open files, defaults to |
|
Maximum locked memory size. Set to |
|
Maximum number of memory map areas a process may have. If you use |
|
Configuration file directory (which needs to include |
|
Any additional JVM system properties you may want to apply. |
|
Configure restart on package upgrade, defaults to |
Distributions that use systemd
require that system resource limits be
configured via systemd
rather than via the /etc/sysconfig/elasticsearch
file. See Systemd configuration for more information.
Directory layout of Debian package
editThe Debian package places config files, logs, and the data directory in the appropriate locations for a Debian-based system:
Type | Description | Default Location | Setting |
---|---|---|---|
home |
Elasticsearch home directory or |
|
|
bin |
Binary scripts including |
|
|
conf |
Configuration files including |
|
|
conf |
Environment variables including heap size, file descriptors. |
|
|
data |
The location of the data files of each index / shard allocated on the node. Can hold multiple locations. |
|
|
logs |
Log files location. |
|
|
plugins |
Plugin files location. Each plugin will be contained in a subdirectory. |
|
|
repo |
Shared file system repository locations. Can hold multiple locations. A file system repository can be placed in to any subdirectory of any directory specified here. |
Not configured |
|
Next steps
editYou now have a test Elasticsearch environment set up. Before you start serious development or go into production with Elasticsearch, you will need to do some additional setup:
- Learn how to configure Elasticsearch.
- Configure important Elasticsearch settings.
- Configure important system settings.
On this page
- Import the Elasticsearch PGP Key
- Installing from the APT repository
- Download and install the Debian package manually
- SysV
init
vssystemd
- Running Elasticsearch with SysV
init
- Running Elasticsearch with
systemd
- Checking that Elasticsearch is running
- Configuring Elasticsearch
- Directory layout of Debian package
- Next steps