Install Elasticsearch

What Elasticsearch is

A search engine that you run yourself. You feed in your products, articles or customers, and get back a search that works the way users expect: it finds the right thing even with typos, ranks the hits by relevance and responds in milliseconds.

Compare that with how search is usually built in an ordinary database, by looking for a piece of text somewhere in a field. That variant finds nothing if the customer writes plasttsskiva instead of plastskiva, and it cannot determine which of thirty hits is the most relevant. Elasticsearch does both.

For a company with a handful of products, it is overkill. If you have a thousand articles, or an archive someone needs to search, the difference is noticeable from day one.

This is a server program

Elasticsearch is not installed like a regular program. It is a service that runs in the background and that your own programs talk to over the network. The easiest way there is Docker, the same tool as in Install Docker. If you do not have Docker in place, start there.

On Windows, Docker Desktop means you also get WSL2, which is Windows' built-in Linux. Docker Desktop normally installs it itself, but if you are asked, you should answer yes.

Also count on memory. Elasticsearch wants at least 4 GB free, and a computer with 8 GB in total becomes slow when it runs. That is not a fault, it is what a search engine costs in resources.

Windows and Linux Mint

The publisher has an installation script for development, and it saves you half an hour of configuration. On Linux Mint, open Terminal and run:

curl -fsSL https://elastic.co/start-local | sh

On Windows, that line does not work in PowerShell. There is no sh there to run the script, and curl is the name of a different command than the Linux version. Run the line in the WSL2 terminal instead, that is, the Ubuntu that came with Docker Desktop: search for Ubuntu in the Start menu, or type wsl in PowerShell to land in it. From there, everything below is the same.

It downloads and starts both Elasticsearch and Kibana, that is, the graphical interface. When it is done, it prints the password and an API key directly in the window. You do not need to copy them by hand: the script saves both in the file .env in the folder elastic-start-local as ES_LOCAL_PASSWORD and ES_LOCAL_API_KEY, and you can read them there again if you miss them in the window.

Elasticsearch then responds at http://localhost:9200 and Kibana at http://localhost:5601.

On Linux, the system often needs a setting raised before the service starts, otherwise it stops immediately with a message about max_map_count:

sudo sysctl -w vm.max_map_count=262144

That setting disappears on restart. If it should remain, add the line below at the end of the file /etc/sysctl.conf, that is, just the setting itself, without sudo sysctl -w in front:

vm.max_map_count=262144

The file is outside your home folder, so it is opened with sudo, for example sudo nano /etc/sysctl.conf (nano comes with Mint from the start; if you have installed micro, that works too, of course).

Three things to do first

1. Check that it is running before you do anything else. The script turns on security, so a call without login responds with an error message about security_exception. Go to the elastic-start-local folder and run this instead:

   source .env
   curl $ES_LOCAL_URL -H "Authorization: ApiKey ${ES_LOCAL_API_KEY}"

   You should get back a response with a version number and a cluster name. If you get no response, it is almost always the memory or the setting above.
2. Add ten real rows from your own project, not sample data. It takes fifteen minutes and you see right away whether your fields are put together in a sensible way. Sample data is always well cleaned up, and your own never is.
3. Search in Kibana instead of writing code. Under Dev Tools you can write searches directly and see the response next to them. It is much faster to learn the query language there than from inside a program you are debugging at the same time.

The most common trap

Opening the gate to the internet. An Elasticsearch instance that is reachable from outside is one of the most common ways databases leak, and there are search engines whose only job is to find open instances. If you have real customer data in there, it is an incident that must be reported, not a technical mishap.

So let it listen only to its own machine while you develop, which it does by default, and do not change that without first having passwords and certificates in place.

The other half is about money. The installation above gives you a one-month trial license with all features turned on. When it expires, the basic features keep working for free, but some of what you have gotten used to stops doing so. So build on the features you know will remain, and check the terms at elastic.co before you rely on anything that looks free.