Skip to main content
protocols.pageprotocols.page
9200

Port 9200 – Elasticsearch HTTP

TCP

Port 9200 is the Elasticsearch REST API port. Elasticsearch also uses port 9300 for inter-node transport. Like Redis, early Elasticsearch versions had no authentication – thousands of public instances were data-breached. Elasticsearch 8.x enables security by default. Port 9200 should be bound to localhost or protected by a reverse proxy with authentication.

Port Number

9200

Protocol

TCP

Service

Elasticsearch REST API

Range

IANA Registered (1024–49151)

Description

Elasticsearch exposes its full REST API on port 9200. Queries, indexing, cluster management, and snapshots all go through this port. Port 9300 is the internal transport protocol for cluster communication. Elasticsearch 8 enables TLS and authentication by default, but many older clusters remain exposed. Use nginx or Kibana as an authenticated frontend rather than exposing port 9200 directly.

Security risks

  • 1No-auth default (pre-8.x): Elasticsearch before version 8 had no authentication. Anyone reaching port 9200 could read all indices, delete data, or execute scripts. Thousands of clusters were breached in 2017-2019 including 800M email records (Verifications.io). Upgrade to 8.x or enable X-Pack security.
  • 2Remote code execution via scripting: Elasticsearch's scripting engine (Groovy pre-5.x, Painless post-5.x) has had multiple RCE vulnerabilities (CVE-2014-3120, CVE-2015-1427). Disable dynamic scripting if not needed: script.allowed_types: none.
  • 3Snapshot exfiltration: an attacker with access to port 9200 can register a snapshot repository pointing to their own S3 bucket and export all indices. Restrict the repository API to admin users only.
  • 4Cluster join abuse: if port 9300 (transport) is also exposed, an attacker can join a rogue node to your cluster, receive shard replicas, and read all data locally.

Firewall guidance

Never expose port 9200 to the internet. Bind to localhost (network.host: 127.0.0.1 in elasticsearch.yml) and proxy through Kibana or Nginx with authentication. For cluster communication (port 9300), restrict to the IPs of other cluster nodes only. Cloud-managed services (Elastic Cloud, AWS OpenSearch) handle this automatically.

Diagnosis commands

Check Elasticsearch version (determines security defaults)

shell
curl -s http://localhost:9200/ | jq .version.number

Cluster health – green/yellow/red status

shell
curl -s http://localhost:9200/_cluster/health?pretty

List all indices sorted by size

shell
curl -s http://localhost:9200/_cat/indices?v&s=store.size:desc

Check JVM heap usage across cluster nodes

shell
curl -s http://localhost:9200/_nodes/stats/jvm | jq '.nodes[].jvm.mem'

Usage examples

Port 9200 – Elasticsearch HTTP
shell
curl http://localhost:9200/_cluster/health
curl http://localhost:9200/_cat/indices?v
curl -XGET 'http://localhost:9200/index/_search?q=field:value'

Common services on this port

ElasticsearchOpenSearchAmazon OpenSearch ServiceElastic CloudBonsai

Related ports

9300

Elasticsearch transport (inter-node)

5601

Kibana (UI for Elasticsearch)

5044

Logstash Beats input

History

Elasticsearch was created by Shay Banon in 2010, built on Apache Lucene. Port 9200 was chosen for the HTTP API, 9300 for inter-node transport. Elastic (the company) added security features via X-Pack (initially paid, free since 6.8/7.1). Version 8.0 (2022) enabled security by default. AWS forked it as OpenSearch in 2021.

FAQ

Elasticsearch vs OpenSearch?

OpenSearch is AWS's fork of Elasticsearch 7.10 (when Elastic changed to SSPL license). Both use port 9200, share the same query DSL, and are largely compatible. OpenSearch has diverged on security (included free from day one) and some features. Choose based on licensing needs and cloud provider.

How do I secure an existing Elasticsearch cluster?

Elasticsearch 8+: security is on by default (auto-generated certs + elastic superuser). Pre-8: enable xpack.security.enabled: true, generate certificates with elasticsearch-certutil, set passwords with elasticsearch-setup-passwords. Then restrict network.host to private IPs and add Nginx/Kibana as the authenticated frontend.