How to install Elasticsearch on Debian 11 (Bullseye)
In this guide you’ll get a working Elasticsearch node on a fresh Debian GNU/Linux 11 (Bullseye) server, from Java setup to firewall tweaks. I’ll point out the bits that usually bite you – like the default‑jdk trap – so you don’t waste an hour chasing logs.
Keep the system sane
Before pulling anything new, make sure your package lists are current and any pending upgrades are applied. Running an outdated kernel or library can cause Elasticsearch to refuse to start.
sudo apt update && sudo apt upgrade -y
sudo apt install apt-transport-https ca-certificates gnupg -y
Why? apt‑transport‑https lets APT talk to Elastic’s HTTPS repo, while the extra cert and gnupg packages give you a clean way to verify signatures.
Java – don’t just “install default‑jdk”
Elasticsearch 7.x expects a Java 11 runtime. On Bullseye the meta package default-jdk currently points at OpenJDK 17, which will make Elasticsearch complain about an unsupported JVM version. I learned that the hard way after staring at a log line that said “Unsupported major.minor version 61”.
sudo apt install openjdk-11-jdk -y java -version
You should see something like openjdk version "11.0.xx"; if you get 17, uninstall it and reinstall the 11 package.
Add Elastic’s APT repository (the right way)
The old apt-key add method is deprecated and throws a warning on recent Debian releases. Instead, drop the key into /usr/share/keyrings and reference it in the source file.
curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elastic.gpg echo "deb [signed-by=/usr/share/keyrings/elastic.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main" | \
sudo tee /etc/apt/sources.list.d/elastic-7.x.list > /dev/null
Why bother? This keeps your keyring tidy and satisfies Debian’s security policy.
Refresh the index and pull the package:
sudo apt update sudo apt install elasticsearch -y
Enable and start the service
Elasticsearch runs as a systemd unit. Enabling it makes sure it survives reboots, while --now starts it immediately.
sudo systemctl enable elasticsearch.service --now
Check that it’s alive:
curl -s http://localhost:9200 | head -n 5
You should see a JSON blob with the cluster name and version. If you get a connection error, glance at the journal:
sudo journalctl -u elasticsearch --no-pager | tail -20
Tweak the network settings (optional but common)
By default Elasticsearch binds only to localhost. For a single‑node dev box that’s fine; for anything you want to reach from another host, edit /etc/elasticsearch/elasticsearch.yml.
sudo nano /etc/elasticsearch/elasticsearch.yml
Add or modify:
network.host: 0.0.0.0 http.port: 9200
Why not just set http.host? The older docs mention it, but in recent versions network.host covers both HTTP and transport layers, so a single line does the job.
Reload the service:
sudo systemctl restart elasticsearch
Open the port in UFW (if you use a firewall)
If your VPS runs UFW, allow traffic to the API port. Otherwise skip this step.
sudo ufw allow 9200/tcp
You can verify with:
sudo ufw status | grep 9200
Quick sanity check
Run a simple query to make sure the node answers:
curl -s http://127.0.0.1:9200/_cluster/health?pretty
A green or yellow status field means you’re good to go.
That’s it – Elasticsearch should now be humming on your Debian 11 box. If anything goes sideways, the systemd journal is usually where the clues live. Happy searching!
