How to Install and Configure Elasticsearch on Debian 11

In this guide, we will learn how to install and configure Elasticsearch on Debian 11.

Elasticsearch is a distributed search and analytics engine built on Apache Lucene. It provides a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents. Elasticsearch has quickly become the most popular search engine and is commonly used for log analytics, full-text search, security intelligence, business analytics, and operational intelligence use cases.

Prerequisites

To follow along, ensure that you have:

An updated Debian 11 server with at least 2 GB of RAM and 2 cores
Root access to the server or user with sudo access
Access to the internet from the server

Table of Content

Ensure the server is up to date
Import Elasticsearch pgp key
Install Elasticsearch from the APT repository
Starting and enabling the Elasticsearch service
Start and enable the Elasticsearch service
Verify the Elasticsearch service
Performing simple operations with Elasticsearch

1. Ensuring that the server is up to date

Before proceeding, let us ensure that our server is up to date and all the packages are the latest version. Use these commands to achieve this:

sudo apt update
sudo apt upgrade -y

If there are packages to upgrade, the above command may take a couple of minutes.

Let us also install some common packages that we will need later:

sudo apt install -y vim wget gnupg2

2. Import the Elasticsearch PGP Key

Elasticsearch signs all of our packages with the Elasticsearch Signing Key (PGP key D88E42B4, available from https://pgp.mit.edu) with fingerprint:

4609 5ACC 8548 582C 1A26 99A9 D27D 666C D88E 42B4

Download and install the public signing key:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

3. Install Elasticsearch from the APT repository

You may need to install the apt-transport-https package on Debian before proceeding:

sudo apt-get install apt-transport-https

Save the repository definition to /etc/apt/sources.list.d/elastic-7.x.list:

echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-7.x.list

You can then install the Elasticsearch package with:

sudo apt-get update && sudo apt-get install elasticsearch

5. Starting and enabling the Elasticsearch service

To start Elasticsearch service, issue this command:

sudo systemctl start elasticsearch

Confirm the status using this command:

$ sudo systemctl status elasticsearch
● elasticsearch.service - Elasticsearch
     Loaded: loaded (/lib/systemd/system/elasticsearch.service; disabled; vendor preset: enabled)
     Active: active (running) since Mon 2022-01-10 03:44:48 UTC; 1min 3s ago
       Docs: https://www.elastic.co
   Main PID: 17426 (java)
      Tasks: 63 (limit: 4626)
     Memory: 2.3G
        CPU: 51.880s
     CGroup: /system.slice/elasticsearch.service
             ├─17426 /usr/share/elasticsearch/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m ->
             └─17616 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller

Jan 10 03:44:26 debiansrv.citizix.com systemd[1]: Starting Elasticsearch...
Jan 10 03:44:48 debiansrv.citizix.com systemd[1]: Started Elasticsearch.

From the above we can see that the service is up and running. To enable the service on boot, use this command:

sudo systemctl enable elasticsearch

If Elasticsearch fails to start for any reason, it will print the reason for failure to STDOUT. Log files can be found in /var/log/elasticsearch/.

By default the Elasticsearch service doesn’t log information in the systemd journal. To enable journalctl logging, the --quiet option must be removed from the ExecStart command line in the elasticsearch.service file.

When systemd logging is enabled, the logging information are available using the journalctl commands:

To tail the journal:

sudo journalctl -f

To list journal entries for the elasticsearch service:

sudo journalctl --unit elasticsearch

To list journal entries for the elasticsearch service starting from a given time:

sudo journalctl --unit elasticsearch --since  "2016-10-30 18:17:16"

6. Verify Elasticsearch

At this point, ElasticSearch is started and listening on port 9200. You can check it with the following command:

$ ss -antpl | grep 9200
LISTEN 0      4096   [::ffff:127.0.0.1]:9200            *:*
LISTEN 0      4096                [::1]:9200         [::]:*

You can also verify ElasticSearch with the following command.

curl -X GET "localhost:9200/"

This is the output on my server:

$ curl -X GET "localhost:9200/"
{
  "name" : "debiansrv.citizix.com",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "eMvGAQK6T0eeasUQxYc9fA",
  "version" : {
    "number" : "7.16.2",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "2b937c44140b6559905130a8650c64dbd0879cfb",
    "build_date" : "2021-12-18T19:42:46.604893745Z",
    "build_snapshot" : false,
    "lucene_version" : "8.10.1",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"

7. Performing simple operations with Elasticsearch

You can use the Curl command to add data to the ElasticSearch as shown below:

curl -H 'Content-Type: application/json' -X POST 'http://localhost:9200/todo/task/1' -d '{ "name": "Go to the mall." }'

You should see the following output:

{"_index":"todo","_type":"task","_id":"1","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":1}

You can now retrieve your data using the GET request:

curl -X GET 'http://localhost:9200/todo/task/1'

You should see the following output:

{"_index":"todo","_type":"task","_id":"1","_version":1,"_seq_no":0,"_primary_term":1,"found":true,"_source":{ "name": "Go to the mall." }}

To retrieve the data in human-readable format, run the following command:

curl -X GET 'http://localhost:9200/todo/task/1?pretty'

You should get the following output:

{
  "_index" : "todo",
  "_type" : "task",
  "_id" : "1",
  "_version" : 1,
  "_seq_no" : 0,
  "_primary_term" : 1,
  "found" : true,
  "_source" : {
    "name" : "Go to the mall."
  }
}

Conclusion

That’s it. In this guide, you we learned how to install and use ElasticSearch on Debian 11. You can now easily add, read, delete, and update data in Elasticsearch.