Recommended Free Tools
Install Elasticsearch from Elastic’s signed Debian or RPM package repository, keep the service running as the unprivileged elasticsearch account, tune the VPS before startup, and expose HTTPS only to the clients that need it. A loopback-bound single node is suitable for a development server; a remotely reachable or multi-node deployment must satisfy production bootstrap checks, use deliberate discovery settings, and be protected with TLS, credentials and a restricted firewall.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the deployment shape before installing
A VPS is not automatically a safe private network. Its public interface, provider firewall and operating-system firewall form a production-like boundary, so decide who must reach Elasticsearch before changing network.host.
As an Amazon Associate I earn from qualifying purchases.
| Use case | Bind address | Discovery settings | Exposure |
|---|---|---|---|
| Local development or a utility node used only on the VPS | Loopback (the default is usually sufficient) | Single-node behavior; no cluster bootstrap required | Keep port 9200 private to the host |
| One application server connecting over a private network | The VPS private address, or an explicitly selected interface | Configure the node as a single-node deployment or provide valid discovery for a cluster | Allow HTTPS on 9200 only from the application network; never open transport port 9300 to the Internet |
| Production cluster | Intentional private interface on every node | discovery.seed_hosts; set cluster.initial_master_nodes only for the first election |
Restrict 9200 to trusted clients and 9300 to cluster members |
Pin a supported Elastic major version before adding a repository. Elastic publishes Debian packages for Debian-based systems and RPM packages for RHEL, CentOS, Oracle Linux, SUSE and openSUSE. Those packages include a bundled OpenJDK, so installing a separate Java runtime is normally unnecessary. Do not mix package repositories from different major versions on one host.
Prepare the Linux VPS
Check the operating system and capacity
Confirm the distribution, release, architecture, available memory and storage before installing. Elasticsearch stores its index data on disk and uses memory for the filesystem cache as well as the JVM heap. Leave operating-system and filesystem-cache headroom instead of assigning all RAM to the heap.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- Use a 64-bit distribution supported by the Elastic major version you selected.
- Keep data on a persistent volume with enough free space for index growth, translogs, temporary merges and snapshots.
- Synchronize the system clock; certificate validity and cluster coordination depend on sane timekeeping.
- Install updates and restrict administrative SSH access before publishing any Elasticsearch port.
Keep package services unprivileged
The package creates an elasticsearch user and group. Do not run the daemon as root. The service account must be able to read /etc/elasticsearch and write its data and log directories, while unrelated users should not be able to read private keys or index data.
Install on Ubuntu or Debian
- Import and verify Elastic’s signing key. Obtain the key through Elastic’s current package-installation instructions, verify its fingerprint out of band, and install it in the system keyring used by APT.
- Add the repository for the major version you selected. Use the Debian package source matching your distribution and pin that major version so an unrelated repository refresh cannot silently move the node to another major release.
- Refresh metadata and install the package.
sudo apt-get update sudo apt-get install elasticsearch - Inspect the package files and service unit. Installation creates the systemd unit and the service account but does not make a public endpoint safe by itself.
If you download a package manually instead of using APT, download the matching .sha512 file and verify it before installation:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchshasum -a 512 -c elasticsearch-<matching-version>-amd64.deb.sha512Replace the filename with the exact package and checksum you obtained; never verify one release with another release’s checksum.
Install on RHEL, CentOS, Oracle Linux, SUSE or openSUSE
- Import Elastic’s signing key using the current RPM repository instructions and verify the fingerprint.
- Add the RPM repository for the chosen supported major version. Ensure the repository’s architecture and distribution path match the VPS.
- Refresh metadata and install Elasticsearch.
sudo dnf makecache sudo dnf install elasticsearchOn older systems that use YUM, use
sudo yum makecachefollowed bysudo yum install elasticsearch. - For a manual RPM download, verify the supplied checksum with the matching SHA-512 file before running the package installer.
Do not install a second Java distribution merely because a generic Elasticsearch tutorial mentions one; the official packages carry a compatible OpenJDK. A separately managed JVM is an exception that should be deliberate and documented.
Know the package layout
Use the distribution’s standard paths when editing, backing up configuration and reading failures. Debian and RPM packages share the principal directories, while environment overrides differ:
| Path | Purpose |
|---|---|
/etc/elasticsearch |
Runtime configuration, including elasticsearch.yml, JVM option fragments and certificates |
/var/lib/elasticsearch |
Index and node data |
/var/log/elasticsearch |
Service and JVM logs |
/etc/elasticsearch/certs |
Automatically generated HTTP and transport certificates and trust material |
/etc/default/elasticsearch |
Debian-family environment overrides |
/etc/sysconfig/elasticsearch |
RPM-family environment overrides |
Preserve ownership when copying files into these directories. A configuration file that is readable only by root, or a data directory owned by the wrong account, will prevent startup.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Apply VPS operating-system settings
Use systemd drop-ins for persistent limits
Package services run under systemd. Put persistent resource limits in a drop-in rather than editing a generated unit:
sudo mkdir -p /etc/systemd/system/elasticsearch.service.d
sudo editor /etc/systemd/system/elasticsearch.service.d/override.conf
sudo systemctl daemon-reloadSet only limits your workload needs. Common checks include open-file limits, process and thread limits, and memory locking. Confirm the effective values with systemd inspection after reloading; a shell’s ulimit does not prove what the service receives.
Set the virtual-memory map limit
Elasticsearch uses memory-mapped files. Check vm.max_map_count and raise it to the value required by the Elastic system-configuration guidance if the VPS is below that requirement. Apply the setting persistently through the distribution’s sysctl configuration, then reload sysctl settings and verify the live value. A bootstrap-check error naming vm.max_map_count means the running kernel value is still too low.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Disable swap whenever possible
Elastic warns that swapping can cause long garbage-collection pauses, slow responses and disconnects. Disable active swap and remove or comment the corresponding persistent entry so it does not return after reboot:
sudo swapoff -aIf your hosting constraints require swap, reduce the risk as far as practical and monitor latency, but do not treat swap as additional Elasticsearch memory.
Use memory locking only when it is configured end to end
With bootstrap.memory_lock: true, the service needs permission to lock its address space. Add LimitMEMLOCK=infinity to the systemd drop-in, reload systemd, restart Elasticsearch and verify in the node’s startup information that locking succeeded. Enabling the setting without the service limit produces a startup failure or a node that is still able to swap.
Configure elasticsearch.yml deliberately
Common identity settings
Set a meaningful cluster and node identity instead of relying on defaults:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
cluster.name: games-search
node.name: vps-search-1Choose a stable node.name; changing it casually makes operations and allocation history harder to follow. The cluster name must be identical on nodes that are intended to form one cluster.
Single-node development configuration
For a test node that does not need clustering, keep the HTTP interface on loopback. A single-node discovery setting can make the intent explicit:
discovery.type: single-nodeThis is convenient for development, not a substitute for a multi-node production design. A loopback-only node cannot be reached by another server until you intentionally change its network binding.
Private-network access from another server
Set network.host to the specific private address or interface that clients should use. Avoid binding all interfaces unless every bound interface is protected by firewall rules and TLS. Changing from loopback to a non-loopback address activates production bootstrap checks, so complete the operating-system preparation before restarting.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteMulti-node discovery
List stable addresses or DNS names of eligible master nodes in discovery.seed_hosts. During the first election only, set cluster.initial_master_nodes to the exact node.name values that should form the initial cluster:
discovery.seed_hosts: ['10.0.0.11', '10.0.0.12', '10.0.0.13']
cluster.initial_master_nodes: ['vps-search-1', 'vps-search-2', 'vps-search-3']After the cluster forms, remove cluster.initial_master_nodes from every node and restart as required by your change process. Leaving it in place risks accidental bootstrap behavior during a later restart or replacement. Ensure private DNS resolves consistently and that nodes can reach one another on the transport network.
Set JVM heap only from measured requirements
Elastic recommends automatic heap sizing for most production nodes. Start with automatic sizing, observe heap pressure, garbage collection and workload behavior, then change the setting only when evidence justifies it.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
If you must override the heap, create a new option fragment under /etc/elasticsearch/jvm.options.d/. The file must end in .options, and the initial and maximum heap must match:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo editor /etc/elasticsearch/jvm.options.d/heap.options-Xms4g
-Xmx4gThe value above is an example of matching values, not a universal recommendation. Size the heap for the VPS and workload while leaving room for the operating system and filesystem cache. Do not edit the root jvm.options file. Avoid ES_JAVA_OPTS for production overrides unless your deployment specifically requires that environment-based approach.
Start Elasticsearch and complete initial security
- Reload systemd after creating or changing a unit drop-in:
sudo systemctl daemon-reload - Enable the service at boot:
sudo systemctl enable elasticsearch.service - Start it:
sudo systemctl start elasticsearch.service - Inspect status and logs immediately if startup does not return cleanly:
sudo systemctl status elasticsearch.service sudo journalctl -u elasticsearch.service -e sudo ls -l /var/log/elasticsearch
On the first start, the package automatically generates TLS material for HTTP and transport and creates an enrollment token. The token is valid for 30 minutes, so use it promptly if you are enrolling another node or client. Treat it as a credential and do not paste it into tickets or shell history that other users can read.
Reset the built-in administrator password
Set a known password for the built-in elastic user with the bundled utility:
sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elasticThe exact binary location can vary with packaging; use the package’s installed bin directory if your distribution places it elsewhere. Store the resulting password in a secrets manager, not in elasticsearch.yml.
Trust the generated HTTP CA
Clients should validate the HTTP certificate using /etc/elasticsearch/certs/http_ca.crt. A test request from the VPS can therefore use:
curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://127.0.0.1:9200Enter the password when prompted. Do not “fix” certificate errors by adding an insecure skip-verification option in production. Install the CA in the client’s trust store or configure the client library with this CA file.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Expose only the endpoint that clients need
HTTP API on port 9200
Port 9200 serves the REST and client API. Keep it on loopback for local-only use. For a remote application, bind to the private interface and permit TCP 9200 only from that application’s private network or security group. Use HTTPS and credentials for every remote request.
Free tools Windows power users keep installed
One-click scans. No signup required.
Transport on port 9300
Port 9300 is for node-to-node transport. Never publish it to the public Internet. In a cluster, allow it only between the addresses of cluster members and ensure transport TLS remains enabled.
Provider and host firewalls
Apply restrictions in both layers available to you: the VPS provider’s network firewall and the operating-system firewall. A deny rule for 9200 or 9300 is not enough if a broader earlier rule allows the same traffic. Review effective rules from outside the VPS and verify that an unexpected public address cannot complete a TLS handshake.
Validate the node before connecting applications
- Confirm the service is active and remains active after a restart.
- Read
/var/log/elasticsearchfor bind, permission, bootstrap and certificate messages. - Make an HTTPS request with the generated CA and credentials.
- Query node or cluster health and confirm the expected number of nodes and status.
- From an application host, test the private address while observing firewall logs.
- From an untrusted network, verify that 9200 and 9300 are not reachable.
Validate the configured bind address, not merely the loopback request. A successful request to 127.0.0.1 proves the process is alive but says nothing about private-network routing, firewall policy or certificate trust on a remote client.
Diagnose bootstrap-check failures
When Elasticsearch binds to a non-loopback address, it enforces production bootstrap checks and refuses to start if required safeguards are missing. Fix the named condition rather than bypassing the check.
Typical symptoms and remedies
| Log symptom | Likely cause | Action |
|---|---|---|
vm.max_map_count is too low |
Kernel map limit was not raised or was not made persistent | Set the required sysctl value, reload it, verify the live value and restart |
| File-descriptor or process limit failure | The systemd service received lower limits than expected | Set limits in the service drop-in, run systemctl daemon-reload, restart and inspect effective limits |
| Memory-lock check fails | bootstrap.memory_lock is enabled without sufficient service permission |
Add LimitMEMLOCK=infinity, reload systemd and verify locking; otherwise disable the setting |
| Discovery or master-election failure | Nodes cannot reach seed hosts, names do not match, or initial master settings are inconsistent | Check private DNS, transport firewall rules, node.name, discovery.seed_hosts and the one-time initial master list |
| Permission denied for configuration, data or logs | Files were copied as root or ownership was changed | Restore package ownership and permissions, then restart as the elasticsearch account through systemd |
| Remote client reports certificate or authentication errors | Client does not trust the generated CA or uses the wrong credentials | Install http_ca.crt in the client trust store and reset or rotate credentials as needed |
Do not solve a bootstrap error by binding publicly while disabling checks, running as root or turning off TLS. Those shortcuts trade a startup message for data exposure or instability.
Back up with snapshots, not filesystem copies
Configure a supported snapshot repository and schedule snapshots appropriate to the value and recovery-point objective of the data. Elastic states that snapshots are the only reliable and supported way to back up a cluster. Copying /var/lib/elasticsearch as a filesystem backup is not supported for restore and should not be your recovery plan.
Test restoration on a separate node or environment, document repository credentials and encryption keys, and monitor snapshot success rather than assuming a scheduled job completed. A snapshot is useful only when you can retrieve it and restore the required indices.
Operational checklist
- Supported major version is selected and the package repository is pinned accordingly.
- Signing key and package checksum were verified before installation.
- Elasticsearch runs as the unprivileged service account.
vm.max_map_count, file limits, thread limits and memory-lock settings match the workload.- Swap is disabled, or its operational risk is explicitly accepted and monitored.
cluster.name,node.nameand network binding reflect the intended topology.cluster.initial_master_nodeswas removed after the first cluster election.- Heap overrides, if any, live in a matching
.optionsfragment with equal-Xmsand-Xmx. - HTTP TLS, transport TLS, credentials and CA trust are tested from the real client.
- Port 9200 is restricted to required clients and port 9300 only to cluster members.
- Node health, logs, disk capacity, JVM pressure and snapshots are monitored.
Single VPS versus a multi-node cluster
| Decision | Single VPS node | Multi-node cluster |
|---|---|---|
| Administration | One package, one configuration and simpler upgrades | Coordinated upgrades, discovery and certificate management across nodes |
| Failure tolerance | A host failure takes the service offline | Can continue through some node failures when quorum and shard allocation are designed correctly |
| Network model | Loopback or one private interface; 9300 is unnecessary | Private transport connectivity between nodes; 9200 remains client-facing |
| Recovery | Snapshots are essential because there is no peer node | Snapshots are still required; replication is not a substitute for backup |
| Best fit | Development, low-risk workloads and small internal tools | Production workloads that require redundancy and planned maintenance |
For either shape, the safe sequence is the same: install a verified package, prepare the kernel and service limits, configure identity and networking, start with TLS and credentials, restrict firewall access, validate health, and establish snapshots before loading irreplaceable data.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
