To properly troubleshoot elasticsearch you first need to make sure that elasticsearch is actually running correctly. Go to QuickLinks and open Elasticsearch Health. Status must be green. Tail your elasticsearch master node log file while restarting to see if there are any issues: tail -f /var/log/elasticsearch/elasticsearch.log Additionally you can edit /etc/elasticsearch/log4j2.properties and set logger.action.level to debug for more verbose logging. Based on the log output, you will likely need to adjust config settings in Advanced elastic-site from Ambari. Here are my settings for a Master Node + 2 Data Nodes: bootstrap_memory_lock true cluster_name elasticsearch cluster_routing_allocation_disk_threshold_enabled true cluster_routing_allocation_disk_watermark_high 0.99 cluster_routing_allocation_disk_watermark_low .97 cluster_routing_allocation_node_concurrent_recoveries 4 discovery_zen_fd_ping_interval 15s discovery_zen_fd_ping_retries 5 discovery_zen_fd_ping_timeout 60s discovery_zen_ping_timeout 3s expected_data_nodes 0 gateway_recover_after_data_nodes 1 http_cors_enabled "true" http_port 9200 index_merge_scheduler_max_thread_count 5 index_number_of_replicas 2 index_number_of_shards 4 index_refresh_interval 1s index_translog_flush_threshold_size 5g indices_cluster_send_refresh_mapping false indices_fielddata_cache_size 25% indices_memory_index_buffer_size 10% indices_memory_index_store_throttle_type none masters_also_are_datanodes "true" network_host [ 0.0.0.0 ] network_publish_host [] path_data "/hadoop/elasticsearch/es_data" recover_after_time 15m threadpool_bulk_queue_size 3000 threadpool_index_queue_size 1000 transport_tcp_port 9300 zen_discovery_ping_unicast_hosts [ "fqdn.hostname1.com", "fqdn.hostname2.com", "fqdn.hostname3.com" ] ... View more