Learn Elasticsearch - Installation & First Steps with Elasticsearch

#Introduction

In episode 2 you understood the architecture — the inverted index, shards, replicas, and node roles. Now that theory will come to life: we'll install Elasticsearch and get it running. Episode 3 is an important moment because from now on you'll interact directly with the REST API — the language you'll use throughout this series. We'll cover four installation methods (package manager, archive, Docker, and Elastic Cloud), how to start and stop Elasticsearch, checking cluster health, understanding the JSON response structure, and getting to know Dev Tools in Kibana. By the end of the episode, you'll have a running Elasticsearch instance and know how to talk to it.

#Installation Methods

#Via Package Manager (APT / YUM)

The most common way for production servers. Elastic provides an official repository:

For the RHEL/Rocky family:

#Via Archive (TAR/ZIP)

Suitable for environments without root access, such as a personal laptop. Download the archive from the official website, extract it, and run it directly:

Download and extract the Elasticsearch archive

curl -fsSL -o elasticsearch.tar.gz https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.15.3-linux-x86_64.tar.gz
tar -xzf elasticsearch.tar.gz
cd elasticsearch-8.15.3
bin/elasticsearch

#Via Docker

The fastest way to experiment. Elasticsearch 8.x has an official image docker.elastic.co/elasticsearch/elasticsearch:8.15.3. We'll discuss Docker and Kubernetes in depth in episode 27, but for a quick test:

Run Elasticsearch via Docker

docker run --name es8 -p 9200:9200 -e "discovery.type=single-node" -e "xpack.security.enabled=false" -d docker.elastic.co/elasticsearch/elasticsearch:8.15.3

Important

The xpack.security.enabled=false variable above disables security to make testing easy. For safe learning, this is practical — but remember, never disable security in production. Episodes 15 and 16 will cover proper hardening. After docker run, wait a few seconds for the node to finish bootstrapping, then check with curl localhost:9200.

#Elastic Cloud / Elasticsearch Service

If you don't want to manage a server, Elastic offers the Elasticsearch Service in the cloud (AWS, GCP, Azure) with a free trial. Deployments come fully secured by default. This method is recommended for production when you don't want to self-manage.

#Starting and Stopping Elasticsearch

After installing via a package manager, use systemd:

Note: on the first start with security enabled, Elasticsearch prints the elastic superuser password to the terminal. Save it carefully. To change it later: bin/elasticsearch-reset-password -u elastic.

#First Access: Cluster Health

#Basic Info

With Elasticsearch running, check the version and node identity:

Node and version information

curl -s localhost:9200

Info response (simplified)

{
  "name": "node-1",
  "cluster_name": "elasticsearch",
  "cluster_uuid": "abc123",
  "version": {
    "number": "8.15.3",
    "lucene_version": "9.11.1"
  }
}

#Cluster Health

The endpoint you'll use most throughout your Elasticsearch career:

Check cluster health

curl -s localhost:9200/_cluster/health?pretty

Example cluster health response

{
  "cluster_name": "elasticsearch",
  "status": "green",
  "number_of_nodes": 1,
  "active_primary_shards": 0, "active_shards": 0,
  "relocating_shards": 0, "unassigned_shards": 0
}

The cluster status has three levels: green (all primary and replica shards are active), yellow (all primaries are active but some replicas aren't assigned yet — normal for a single node), and red (some primary shard is inactive — data can't be fully read).

#Understanding the JSON Response Structure

Every Elasticsearch API response follows a pattern: took (execution time in milliseconds), timed_out (whether it timed out), and _shards (a summary of the shards involved). For write operations, there are the result field (created, updated, deleted, noop) and _version, which increments each time a document is modified.

Get into the habit of using the ?pretty parameter to format JSON and ?filter_path= to filter specific fields — the response then contains only the requested fields, which is very useful when parsing automatically with scripts:

Filter the response to keep it concise

curl -s 'localhost:9200/_cluster/health?filter_path=status,nodes,unassigned_shards'

#Kibana and Dev Tools

Kibana is the official graphical interface. Install a version that exactly matches Elasticsearch:

Open http://localhost:5601 and log in with the elastic user. In Kibana there's Dev Tools → Console — an editor that lets you write Elasticsearch requests without curl:

Example request in Dev Tools Console

GET /_cluster/health

Just write the HTTP method and path, then click the play button. Dev Tools even has autocomplete for the query DSL — this will become your main tool for practice in the coming episodes. All curl examples in this series can be typed directly into Dev Tools.

Tip

In a production environment, never expose port 9200 to the internet without authentication. For local development, restricting to localhost is enough. The network.host configuration will be covered in episode 16. For now, just make sure Elasticsearch is accessible from your machine.

#Common Errors

Port 9200 already in use. Error: bind: address already in use. Check with ss -tlnp and kill the process using the port.
JVM heap too small. Error: unable to create native thread. Increase ES_JAVA_OPTS=-Xms4g -Xmx4g or configure it in jvm.options.
Low file descriptor limit. Error: max file descriptors [4096] for elasticsearch process is too low. Raise the limit: ulimit -n 65535 or configure it in limits.conf.
Different Elasticsearch and Kibana versions. Kibana refuses the connection with a version mismatch message. Match both versions.
Forgetting the superuser credentials. The password is printed once on first boot. If you forget it, reset it with bin/elasticsearch-reset-password -u elastic.

#Conclusion

In episode 3 you successfully installed and ran Elasticsearch: four installation methods (APT/YUM, archive, Docker, and Elastic Cloud), managing the service with systemd, checking cluster health (green/yellow/red), understanding the JSON response structure, and getting to know Dev Tools in Kibana. You also learned how to talk to Elasticsearch via curl localhost:9200.

Key takeaways:

Four installation paths: package manager, archive, Docker, Elastic Cloud.
Cluster status: green, yellow, red — always check it via _cluster/health.
Since 8.x, security is enabled by default; save the elastic password from first boot.
Use ?pretty and ?filter_path= for readable responses.
Dev Tools in Kibana is the best request editor for learning.

Your Elasticsearch is alive and ready to accept commands. In episode 4 we'll start the first real operations: index management and document operations (CRUD) — creating indexes with settings and mappings, working with documents via the index/get/update/delete APIs, using the bulk API for batches, and getting to know index aliases and templates. See you there!