elastic search

Elasticsearch plugins extend its functionality — common ones include repository plugins for S3/GCS snapshots, analysis plugins for language support, and security plugins.

Install a plugin

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch PLUGIN_NAME

The --batch flag skips the interactive confirmation prompt (useful for scripts).

Common plugins

# AWS S3 repository (for snapshots to S3)
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch repository-s3

# GCS repository (Google Cloud Storage)
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch repository-gcs

# ICU analysis (Unicode text analysis)
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install --batch analysis-icu

List installed plugins

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin list

Remove a plugin

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin remove PLUGIN_NAME

Restart Elasticsearch after plugin changes

sudo systemctl restart elasticsearch

Note: Plugin installation requires a restart to take effect. In a multi-node cluster, perform rolling restarts to avoid downtime.

Elasticsearch requires a significant amount of heap memory. On small VMs, it may fail to start with a Cannot allocate memory or Java Virtual Machine error.

Symptoms

# In /var/log/elasticsearch/elasticsearch.log:
OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(...) failed
# Or:
Exception in thread "main" java.lang.OutOfMemoryError

Fix – Reduce the JVM heap size

Edit /etc/elasticsearch/jvm.options:

# Set heap to 512MB (for small VMs with 1–2 GB RAM)
-Xms512m
-Xmx512m

# For a VM with 4 GB RAM, use ~50% of RAM:
-Xms2g
-Xmx2g

Rule of thumb: Xms and Xmx should be equal, and no more than 50% of physical RAM (Elasticsearch needs memory for the OS file system cache too). Maximum recommended: 31 GB.

Fix – Disable memory swapping

Add to /etc/elasticsearch/elasticsearch.yml:

bootstrap.memory_lock: true

Then allow the service to lock memory — add to /etc/systemd/system/elasticsearch.service.d/override.conf:

[Service]
LimitMEMLOCK=infinity

sudo systemctl daemon-reload
sudo systemctl restart elasticsearch

Fix – Add swap space (last resort)

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile && sudo swapon /swapfile

Quick reference for where Elasticsearch stores its files on a standard Debian/Ubuntu or RPM-based installation.

Configuration

• /etc/elasticsearch/elasticsearch.yml — main configuration file
• /etc/elasticsearch/jvm.options — JVM heap size and GC settings
• /etc/elasticsearch/log4j2.properties — logging configuration

Data and logs

• /var/lib/elasticsearch/ — index data (change with path.data)
• /var/log/elasticsearch/ — log files (change with path.logs)

Binaries and plugins

• /usr/share/elasticsearch/bin/ — CLI tools (elasticsearch, elasticsearch-plugin)
• /usr/share/elasticsearch/plugins/ — installed plugins

Service

• /etc/default/elasticsearch (Debian) or /etc/sysconfig/elasticsearch (RHEL) — environment variables for the service

Verify current paths via API

curl -s http://localhost:9200/_nodes/stats/fs | python3 -m json.tool | grep path

Custom paths in elasticsearch.yml

path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch

When Elasticsearch fails to start with an "Insufficient Memory" error, it means the configured JVM heap size exceeds available system memory.

Diagnose the heap configuration

cat /etc/elasticsearch/jvm.options | grep -E "^-Xm"

Compare the heap values against available RAM:

free -h

Fix – Lower the heap size in jvm.options

sudo nano /etc/elasticsearch/jvm.options

Change the Xms/Xmx values to fit your available memory:

# For a 1 GB RAM server:
-Xms256m
-Xmx256m

# For a 2 GB RAM server:
-Xms512m
-Xmx512m

# For a 4 GB RAM server:
-Xms1g
-Xmx1g

Keep Xms = Xmx. Never set heap above 31 GB or more than 50% of physical RAM.

Apply and verify

sudo systemctl restart elasticsearch
sudo systemctl status elasticsearch

# Confirm heap size in use
curl -s http://localhost:9200/_nodes/stats/jvm |   python3 -c "import sys,json; d=json.load(sys.stdin);   [print(n, v['jvm']['mem']['heap_max_in_bytes']//1024//1024,'MB')   for n,v in d['nodes'].items()]"