How to install and configure Elasticsearch on CentOS

Elasticsearch is a distributed search and analytics engine for indexing application records, logs and metrics. On CentOS Stream, RHEL and related Fedora systems, the signed package route creates a service account, data directories and a systemd unit, making upgrades easier to control than unpacking a tarball. This example uses one node; a real cluster needs different discovery, networking and certificate settings.

Check the CentOS release and resources before selecting a package. CentOS 7 is end-of-life, so use supported Stream or RHEL for an Australian production service unless a legacy requirement dictates otherwise. The Linux Unix tutorials collection covers the surrounding yum/dnf and permission basics before you apply these Elasticsearch-specific steps.

Prepare the CentOS host

Use Elastic’s signed repository for the Elasticsearch major version you intend to run. yum is aliased to dnf on current CentOS Stream releases, so the same commands work on either. First inspect the host:

cat /etc/centos-release
uname -m
free -h
df -h

Confirm that the host has enough room for indexes, logs and filesystem cache. A 4 GB VM is a practical starting point for a small test node, while production sizing depends on ingest rate, retention and query load.

Add the official repository and install the package. This example selects the 8.x line; check the compatibility matrix when using an older Stream or RHEL release.

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
sudo tee /etc/yum.repos.d/elasticsearch.repo >/dev/null <<'EOF'
[elasticsearch]
name=Elasticsearch repository for 8.x
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autoinstall=1
EOF
sudo yum clean all
sudo yum install elasticsearch

Before starting the service, configure time and host limits. Australian daylight-saving changes between AEST and AEDT, so synchronise the clock with an Australian NTP source such as au.pool.ntp.org and keep Elasticsearch timestamps in UTC. For a hosted node, choose an AWS Sydney or Melbourne region, or an Azure Australian region, close to users and data sources. Keep port 9200 closed until the access design is settled.

Configure a single-node installation

Open /etc/elasticsearch/elasticsearch.yml with sudo vi and add a small baseline:

cluster.name: au-search
node.name: au-node-01
network.host: 127.0.0.1
http.port: 9200
discovery.type: single-node

network.host: 127.0.0.1 suits a local Nginx proxy. discovery.type: single-node is appropriate only for this standalone example; remove it and configure seed hosts before joining a cluster.

On a fresh 8.x package, retain the automatically generated security and TLS settings. Do not set xpack.security.enabled: false on a reachable network. If an older or customised install lacks certificates, generate them with Elastic’s certificate utility first. For a 4 GB host, an example heap file contains -Xms2g and -Xmx2g; never exceed roughly half of RAM without testing.

Persist the kernel limit, review the SELinux policy for an Nginx proxy, and start the service:

printf 'vm.max_map_count=262144\n' | sudo tee /etc/sysctl.d/99-elasticsearch.conf
sudo sysctl --system
sudo systemctl enable --now elasticsearch

Verify Elasticsearch locally

Use systemd and the journal to catch startup, JVM, certificate and memory errors:

sudo systemctl status elasticsearch --no-pager
sudo journalctl -u elasticsearch -n 100 --no-pager

Reset the built-in password only if needed, then test the TLS endpoint with its CA certificate:

sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -i
sudo curl --cacert /etc/elasticsearch/certs/http_ca.crt \
  --user elastic https://localhost:9200

An authenticated JSON response confirms that the node is listening. Create a temporary index and query it through the same API, then delete it; this verifies ingestion and search rather than merely checking that port 9200 accepts a connection.

Keep 9200 on loopback or a private network. For remote use, expose an authenticated TLS endpoint through Nginx or a VPN and restrict firewalld to required sources. Australian NBN, 4G and 5G links may use carrier-grade NAT, making port forwarding unreliable; a site-to-site VPN or SSH tunnel is safer.

Keep a practical change checklist

Australian operators often ask for a quick sanity check before and after a maintenance window; keep handover notes in Australian English, using licence for the noun and license for the verb. A technician may use a tablet as a field companion, and the tablet installation guide covers installation and best-setting choices; keep the actual Elasticsearch endpoint behind VPN or proxy protection.

Before changing the node, confirm the following:

• Confirm the CentOS release and Elasticsearch version are supported together.
• Check free disk, memory pressure, heap usage and current cluster health.
• Back up elasticsearch.yml, JVM options and relevant data-path settings.
• Record the expected health response and a rollback point.

After changing the node, verify the following:

• Run systemctl is-active elasticsearch and inspect recent journal entries.
• Query the authenticated API and test one representative index or search.
• Confirm certificate expiry, disk watermarks and backup or snapshot status.
• Record the result, owner and next review date in the change log.

Keep this checklist with the service runbook, alongside version and certificate details. If Elastic Cloud is preferred, check current Australian region availability, data-residency terms and USD prices against the AUD budget; hosted regions and pricing can differ from a local VM.

Maintain a dependable Australian deployment

Plan upgrades and major-version changes through a tested maintenance window, with a snapshot or tested backup first. Monitor heap, disk watermarks, cluster status, certificate expiry and ingestion errors, and keep Kibana, Logstash and Beats compatible with Elasticsearch.

Teams in Sydney, Melbourne and regional Australian offices should record the relevant UTC-to-local conversion, including AEST and AEDT where applicable, and keep a documented VPN route for support. The durable lesson is that a supported package, authenticated TLS, a private port and a verified health response form the dependable foundation for Elasticsearch in Australia.