Deploying Elasticsearch 8.x on Windows 10: Step-by-Step Guide with TLS and Kibana Setup

Environment Requirements

The author uses a Windows 10 machine with VMware installed, which provides a virtual network adapter. The virtual network is configured as a private network to simulate a production-like isolated environment.

VMware Network Configuration

In VMware's Virtual Network Editor, the VMnet1 adapter is set to "Host-only" mode with subnet IP 192.168.10.0 and subnet mask 255.255.255.0. DHCP is disabled to allow static IP assignment.

Windows Network Configuration

The host machine's VMware Network Adapter VMnet1 is assigned a static IPv4 address: 192.168.10.2 with subnet mask 255.255.255.0. No default gateway or DNS is configured, keeping traffic local.

Hostname Verification

The hostname is retrieved via hostname command (output: DESKTOP-XXXXXXX) and will be used in Elasticsearch configuration.

Elasticsearch Deployment Process

1. Download and Extract

Elasticsearch 8.7.1 Windows zip package is downloaded and extracted to D:\elasticsearch-8.7.1.

2. Certificate Generation

Certificates are generated using elasticsearch-certutil.bat in the bin directory, following the same method as the previous Linux deployment but adapted for Windows command prompt.

Generate CA and Transport Certificate

cd D:\elasticsearch-8.7.1\bin
.\elasticsearch-certutil.bat cert -ca -pem -out config/certs/elastic-certificates.p12

The command creates a CA and a transport certificate bundle in PKCS#12 format. The tool prompts for a password; the author uses the same password for simplicity.

Generate HTTP Certificate

.\elasticsearch-certutil.bat cert -ca config/certs/elastic-certificates.p12 -pem -out config/certs/http.p12

This generates an HTTP certificate signed by the previously created CA, also in PKCS#12 format.

3. Elasticsearch Configuration (elasticsearch.yml)

The configuration file is edited to enable security (TLS) and cluster formation. Key settings include cluster name, node name, network host, discovery seed hosts, initial master nodes, and SSL/TLS paths for transport and HTTP layers. The exact values are shown in the screenshot; the author notes they mirror the Linux deployment configuration.

4. Place Certificates

The generated certificate files are copied to the config/certs/ directory: elastic-certificates.p12 (CA + transport) http.p12 (HTTP)

elastic-certificates.p12
http.p12

5. Start Elasticsearch Service

Run elasticsearch.bat from the bin directory. The console output shows successful startup with cluster health turning green, indicating a healthy single-node cluster.

Health status is green, confirming the cluster is operational.

6. Browser Access and Password Reset

Accessing https://192.168.10.2:9200 prompts for authentication. The elastic user password is reset using the elasticsearch-reset-password.bat tool.

cd D:\elasticsearch-8.7.1\bin
.\elasticsearch-reset-password.bat -u elastic

After entering the new password, browser authentication succeeds and returns the cluster information JSON, confirming Elasticsearch service is normal.

Kibana Configuration

1. Reset kibana_system User Password

The built-in kibana_system user password is reset similarly:

.\elasticsearch-reset-password.bat -u kibana_system

2. Configure kibana.yml

The Kibana configuration file is updated to connect to Elasticsearch with the new credentials and enable SSL. Settings include elasticsearch.hosts, elasticsearch.username, elasticsearch.password, elasticsearch.ssl.certificateAuthorities, and server.ssl.enabled with certificate paths.

3. Place Certificates for Kibana

The CA certificate ( elastic-certificates.p12) is copied to Kibana's config directory for SSL verification.

4. Start Kibana Service

Run kibana.bat from the Kibana bin directory. The console shows successful startup and listening on port 5601.

5. Verify Kibana Service

Access https://192.168.10.2:5601 in browser, log in with the elastic user and the reset password. The Kibana home page loads successfully, confirming the full stack is operational.

The article concludes that the entire process deploys Elasticsearch 8.7.1 with security (TLS) and Kibana on Windows 10, suitable for development and testing environments. Production deployment on Windows is not recommended.