Why self-host Elasticsearch on a VPS
Elasticsearch shines where simple search no longer suffices: fine scoring, nested aggregations, multilingual analysis, geo-queries, and the ELK stack to centralize your logs. Managed cloud offerings (Elastic Cloud, OpenSearch Service) quickly become costly once you exceed a few gigabytes indexed. On your VPS, you control the version, the analysis plugins (such as the French analyzer or ICU), the retention of your logs, and you avoid outbound transfer fees. It is also the way to keep sensitive data strictly on your infrastructure.
The benefits of an in-house Elasticsearch
- Advanced full-text search: BM25 scoring, synonyms, custom linguistic analyzers
- Complex aggregations and facets for e-commerce or analytics
- A complete ELK stack (Logstash/Beats + Kibana) to centralize your logs at no extra cost
- Full control of the version, plugins and index lifecycle policies
- No billing per indexed volume or egress fees
- Snapshots to your own object storage for disaster recovery
Realistic prerequisites
Elasticsearch runs on a JVM and is RAM-hungry: do not go below 4 GB for a test, aim for 8 GB (2-4 vCPU) for light production use, and 16 GB as soon as you index several million documents or add Kibana. Set the JVM heap to 50% of RAM (without exceeding 32 GB). On the system side, increase vm.max_map_count=262144, disable swap, provide a fast SSD, Docker + Compose, and an es.yourdomain.com subdomain.
Step-by-step deployment
Prepare the kernel and the system
First of all: sysctl -w vm.max_map_count=262144 (and persist it in /etc/sysctl.conf). Disable swap or reserve memory with bootstrap.memory_lock=true. These settings prevent crashes at startup.
Define the Docker service with a controlled heap
In docker-compose.yml, use docker.elastic.co/elasticsearch/elasticsearch:8.13.0, set ES_JAVA_OPTS=-Xms4g -Xmx4g, mount a named volume for /usr/share/elasticsearch/data and expose port 9200 only on 127.0.0.1.
Enable native security
Since 8.x, TLS security is enabled by default. Run docker compose up -d, then generate the elastic password with bin/elasticsearch-reset-password -u elastic. Keep it in a secrets manager.
Expose via HTTPS reverse proxy
Place Nginx or Caddy in front of port 9200 to serve es.yourdomain.com over public HTTPS, with additional basic authentication on the proxy side if the API must be reached from outside.
Configure snapshots
Register a repository of type s3 or fs (PUT _snapshot/backup) pointing to an object storage, then create a Snapshot Lifecycle Policy (SLM) for automatic daily backups with retention.
Add Kibana (optional)
Add a kibana:8.13.0 service in the same Compose, connected to the internal Docker network, and expose it behind the proxy on kibana.yourdomain.com to explore your indexes and build dashboards.
Set up Index Lifecycle Management (ILM) policies from the start: hot/warm/cold phases that automatically reduce the number of replicas and force-merge segments on old indexes. On a VPS where disk space is at a premium, this is what prevents your logs from saturating the SSD and keeps queries fast on hot data.
