Production checklist
Elasticsearch production checklist: 5 checks before launch
5 checks for running Elasticsearch in production: 1 must-do, 3 should-dos and 1 good-to-have. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (1)
Keep security enabled: authentication and TLS
Open Elasticsearch clusters are a leading cause of large data leaks.
Verify with a request
An unauthenticated request should get 401, and only https:// should work.
curl -s -o /dev/null -w "%{http_code}\n" https://<host>:9200/
Should do (3)
Schedule snapshots to object storage
Your only way back after a bad mapping change or deletion.
Verify with a request
A snapshot lifecycle policy exists and its last_success is recent.
curl -s -u <user> "https://<host>:9200/_slm/policy?pretty"
Keep port 9200 on a private network
Exposed clusters are found by scanners within hours.
Verify from the command line
From outside your network, a connection to port 9200 should time out.
curl -s --max-time 10 https://<host>:9200/ || echo "not reachable"
Give the app an API key with only the index privileges it needs
A leaked key then can’t read other indices or change cluster settings.
Verify with a request
Authenticate with the app’s key: the roles should cover only its own indices.
curl -s -H "Authorization: ApiKey <key>" "https://<host>:9200/_security/_authenticate?pretty"
Good to have (1)
Watch disk use against the allocation watermarks
Past the flood-stage watermark Elasticsearch makes indices read-only and writes fail.
Verify with a request
disk.percent should stay below the low watermark (85% by default); alert before it gets there.
curl -s -u <user> "https://<host>:9200/_cat/allocation?v"
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.