Use the test that matches your installation
For a security-enabled local package or archive installation, use the CA certificate generated during setup and authenticate as a configured user:
export ELASTIC_PASSWORD='your-password'
curl --cacert config/certs/http_ca.crt \
-u elastic:$ELASTIC_PASSWORD \
https://localhost:9200On an RPM installation, the CA path is commonly /etc/elasticsearch/certs/http_ca.crt. On Windows PowerShell, keep the password in a temporary environment variable and use curl.exe if you need curl-compatible flags.
Do not publish passwords in shell history, screenshots, or support requests. Prefer environment variables, a secrets manager, or an Elasticsearch client’s secure credential configuration.
What the result means
| Result | Meaning | Next action |
|---|---|---|
| JSON with node and version data | The HTTP endpoint, TLS, and authentication succeeded. | Use a narrower API such as cluster health for the next check. |
| Connection refused | No listener at that address and port. | Check service status, startup logs, bind address, and container publishing. |
Empty reply from server after HTTP | A common cause is speaking plain HTTP to an HTTPS endpoint. | Retry with the documented HTTPS and CA configuration; confirm in logs. |
| Certificate verify error | The endpoint responded with TLS, but the client does not trust or match the certificate. | Use the generated CA file and the hostname covered by the certificate. |
| HTTP 401 | The endpoint is reachable; credentials are missing or invalid. | Use a valid user, API key, or supported token. |
| HTML page | You may be reaching a proxy or another product. | Identify the process and inspect response headers. |
Check the process and logs
# systemd-based Linux
sudo systemctl status elasticsearch
sudo journalctl -u elasticsearch --since "10 minutes ago"
# Check listeners
ss -ltnp | grep ':9200'
# Windows PowerShell
Get-NetTCPConnection -LocalPort 9200 -State ListenStartup logs are essential when a node exits before opening the port. Address memory, permissions, configuration, discovery, and bootstrap-check failures from the exact logged message; changing firewall rules cannot fix a process that never started.
9200 is not 9300—and not Kibana
- 9200: Elasticsearch’s client-facing HTTP interface, commonly used by REST clients and Kibana.
- 9300: the transport interface used for node-to-node communication; it is not the REST endpoint.
- 5601: Kibana’s common web-server port. A healthy Elasticsearch JSON response on 9200 is not intended to be a browser dashboard.
Elasticsearch in Docker
# Inspect running containers and published ports
docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
# Read the node's startup output
docker logs <container-name>
# Check that host port 9200 maps to container port 9200
docker port <container-name> 9200If Compose maps 127.0.0.1:9201:9200, the host URL is on 9201, not 9200. Retrieve the generated enrollment and authentication details from the deployment workflow instead of disabling security to make a quick curl command work.
Binding and exposure
Elasticsearch has separate HTTP and transport interfaces. Network settings can trigger bootstrap checks when a node binds beyond local addresses. Treat those checks as required safeguards, not obstacles to bypass.
Never expose an unprotected Elasticsearch node to the public internet. An exposed REST API can allow data to be read, changed, or deleted. Use authentication, TLS, network controls, and least-privilege roles.
After connectivity works
curl --cacert config/certs/http_ca.crt \
-u elastic:$ELASTIC_PASSWORD \
'https://localhost:9200/_cluster/health?pretty'A red or yellow cluster status is an Elasticsearch allocation issue, not a localhost reachability issue. Continue with cluster logs and allocation APIs once the authenticated HTTP request succeeds.
Official references
- Elastic: Secure cluster communicationsDistinguishes the HTTP interface on 9200 from transport on 9300.
- Elastic: Networking settingsHTTP and transport ports, binding, and exposure warnings.
- Elastic: Check that Elasticsearch is runningAuthenticated HTTPS test with the generated CA certificate.
- Elastic: Bootstrap checksChecks that become mandatory when binding to non-loopback addresses.