Elastic Certified Engineer: Installation and Configuration

What to know

Configuration lives under $ES_HOME/config: elasticsearch.yml for node and cluster settings, jvm.options (plus anything dropped into jvm.options.d/) for heap and GC, log4j2.properties for logging, and the elasticsearch.keystore for secrets. Capabilities are declared with node.roles (master, data, data_hot, ingest, ml, remote_cluster_client, and so on); a node with an empty role list is coordinating-only. Cluster formation uses discovery.seed_hosts to locate master-eligible peers and cluster.initial_master_nodes to bootstrap the very first election.

Traps

• cluster.initial_master_nodes belongs only to the initial bootstrap. Leaving it in place after the cluster exists can stop nodes from joining on restart. It is not a list of "current masters".
• Setting network.host to anything other than a loopback address switches the node into production mode and turns on bootstrap checks (memory lock, vm.max_map_count, discovery configuration). Bind deliberately.
• Xms must equal Xmx, and the heap should stay under roughly 50% of RAM and at or below ~30 GB so compressed oops remain available.
• Elasticsearch refuses to start as root, and path.data must be writable by the service user.
• Settings that must be secure (passwords, TLS keystore passwords) are added with elasticsearch-keystore add and are read from the keystore rather than from elasticsearch.yml.

Rule of thumb

Bootstrap a fresh cluster with cluster.initial_master_nodes, confirm green health, then remove that setting from every node's YAML before the next restart.