TCPRegistered PortFirewall: Usually Closed
9200

Elasticsearch HTTP

What is Port 9200?

Port 9200 is the default HTTP/REST API port for Elasticsearch, the distributed search and analytics engine at the core of the Elastic Stack. Elasticsearch provides near real-time search and analytics capabilities for all types of data — structured, unstructured, geospatial, and metrics. It's used for log analysis, full-text search, security analytics, application monitoring, and business intelligence. The REST API on port 9200 handles document indexing, search queries, cluster management, and index operations. Elasticsearch can scale from a single node to clusters of hundreds of nodes handling petabytes of data. It powers search for Wikipedia, GitHub, Stack Overflow, and thousands of other organizations.

Common Uses

  • Full-text search engine for applications
  • Log aggregation and analysis (ELK Stack)
  • Security information and event management
  • Application performance monitoring data store

Technical Details

Port Number9200
ProtocolTCP
CategoryRegistered
Service NameElasticsearch HTTP
Default FirewallUsually Closed
Port Test Commands

Copy-paste commands to check port 9200 (Elasticsearch HTTP) from your terminal

Test connectivity

Netcat (nc)Check if TCP port is reachable
nc -zv example.com 9200
curl (HTTP)Test HTTP response on this port
curl -v --max-time 5 http://example.com:9200/
TelnetBasic TCP port connectivity check
telnet example.com 9200
nmapScan port 9200 with service detection
nmap -p 9200 -sV example.com
Bash /dev/tcpPure bash TCP check (no extra tools needed)
(echo > /dev/tcp/example.com/9200) 2>/dev/null && echo "open" || echo "closed"

Open port in firewall

UFW (Ubuntu / Debian)
sudo ufw allow 9200/tcp
iptables
sudo iptables -A INPUT -p tcp --dport 9200 -j ACCEPT
firewalld (RHEL / CentOS)
sudo firewall-cmd --permanent --add-port=9200/tcp && sudo firewall-cmd --reload

Security Considerations

!

Elasticsearch without authentication has been the cause of countless data breaches — exposed instances have leaked millions of records. Always enable Elastic Security features (authentication, TLS, RBAC). Never expose port 9200 to the internet. Use Kibana as the user-facing interface behind authentication. Implement field-level and document-level security for multi-tenant deployments.

Popular Ports Reference

The most commonly used and referenced network ports

Related Ports