Install Elasticsearch and Kibana on VPS

June 2026 · 9 min read

Elasticsearch is a powerful search engine and analytics platform used for full-text search in applications, log analytics (ELK Stack), or real-time data pipelines. Kibana is the UI for visualizing data within Elasticsearch. You'll need a VPS with at least 4GB of RAM to run it effectively.

Install Elasticsearch 8

sudo apt update
sudo apt install apt-transport-https -y

# Import GPG key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
  sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

# Add repository
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] \
  https://artifacts.elastic.co/packages/8.x/apt stable main" | \
  sudo tee /etc/apt/sources.list.d/elastic-8.x.list

sudo apt update
sudo apt install elasticsearch -y

# Start service
sudo systemctl enable --now elasticsearch

# Save the password displayed during install (use once only)
# Or reset password to a new one
sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

Configure Elasticsearch for Single-Node

sudo nano /etc/elasticsearch/elasticsearch.yml

cluster.name: my-cluster
node.name: node-1
network.host: 127.0.0.1  # bind localhost only for security
http.port: 9200

# For single node, disable discovery
discovery.type: single-node

# Set JVM heap size (half of RAM but not exceeding 30GB)
# Edit in /etc/elasticsearch/jvm.options.d/jvm.options
# -Xms2g
# -Xmx2g

Install Kibana

sudo apt install kibana -y
sudo systemctl enable --now kibana

sudo nano /etc/kibana/kibana.yml

server.host: "127.0.0.1"
server.port: 5601
elasticsearch.hosts: ["https://localhost:9200"]
elasticsearch.ssl.verificationMode: none  # for local dev

# Create enrollment token for Kibana
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

Test Elasticsearch API

# Test connection
curl -k -u elastic:YOUR_PASSWORD https://localhost:9200

# Create index
curl -k -u elastic:YOUR_PASSWORD -X PUT https://localhost:9200/products \
  -H "Content-Type: application/json" \
  -d '{"settings": {"number_of_replicas": 0}}'

# Index document
curl -k -u elastic:YOUR_PASSWORD -X POST https://localhost:9200/products/_doc \
  -H "Content-Type: application/json" \
  -d '{"name": "VPS Thailand", "price": 299, "category": "hosting"}'

# Search
curl -k -u elastic:YOUR_PASSWORD "https://localhost:9200/products/_search?q=vps"

Elasticsearch requires a VPS with high resources and fast SSD. For servers supporting heavy workloads like this, Singapore VPS from asiagb offers NVMe SSD and high RAM, ideal for Elasticsearch and analytics pipelines. Before production, verify cluster connectivity using dnsxray.com.

Verify Elasticsearch is Working Correctly

# Check cluster health
curl -k -u elastic:YOUR_PASSWORD https://localhost:9200/_cluster/health?pretty

# View nodes
curl -k -u elastic:YOUR_PASSWORD https://localhost:9200/_cat/nodes?v

# View all indices
curl -k -u elastic:YOUR_PASSWORD https://localhost:9200/_cat/indices?v

# View logs
sudo journalctl -u elasticsearch -n 50

Common Issues & Troubleshooting

Elasticsearch Won't Start — "max virtual memory areas vm.max_map_count too low"

Elasticsearch requires more virtual memory than the default setting. Increase the kernel parameter:

sudo sysctl -w vm.max_map_count=262144
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
sudo systemctl restart elasticsearch

Kibana Cannot Connect to Elasticsearch — "Unable to retrieve version information"

Kibana 8 requires HTTPS with Elasticsearch. Plain HTTP will fail. Check your config:

# Check if Elasticsearch is using HTTPS
curl -k https://localhost:9200  # should respond (use -k for self-signed cert)

# If using HTTP (security disabled in yml)
xpack.security.enabled: false  # dev only

Heap Space Error Causes Node Crash

JVM heap is insufficient. Adjust Xms/Xmx to match your available RAM:

sudo nano /etc/elasticsearch/jvm.options.d/custom.options

-Xms1g   # minimum heap (1GB for 4GB RAM VPS)
-Xmx1g   # maximum heap (must equal Xms)

sudo systemctl restart elasticsearch

Query Very Slow on Large Index

No index on frequently queried fields, or wrong field type (text vs keyword):

# View index mapping
curl -k -u elastic:PASS https://localhost:9200/myindex/_mapping?pretty

# Add keyword field for exact match + sorting
PUT /myindex/_mapping
{"properties": {"category": {"type": "keyword"}}}

Frequently Asked Questions

How Much RAM Does Elasticsearch Need?

For development: 2GB RAM is sufficient. For production with small data: 4GB, medium data: 8–16GB. The rule is to allocate JVM heap to half of RAM but not exceeding 30GB. The other half is reserved for OS cache, used by Lucene for file system caching.

What's the Difference Between ELK Stack and OpenSearch?

OpenSearch is an open-source fork of Elasticsearch created by AWS after Elastic changed its license. Features are similar. Use OpenSearch Service if you're on AWS, or either works fine if self-hosting on your VPS.

How Do I Secure Kibana from Public Access?

Bind Kibana to localhost and access it via SSH tunnel, or set up an Nginx reverse proxy with Basic Auth in front of Kibana. Never expose port 5601 directly to the public.