Elasticsearch状态正常但无法通过公网IP:9200连接求助

问题背景 #

Elasticsearch服务状态显示活跃，日志无报错，配置文件在其他实例可正常运行，但无法通过http://<publicip>:9200从公网访问服务。

排查步骤 #

• 本地端口验证
  在Elasticsearch所在机器上执行curl http://127.0.0.1:9200或curl http://10.50.11.77:9200，确认服务本地响应正常。同时用ss -tulpn | grep 9200检查9200端口是否被Elasticsearch进程监听，需确保输出包含0.0.0.0:9200或对应内网IP的监听记录。

• 系统防火墙检查
  查看系统防火墙是否开放9200端口：

  • 若用firewalld：执行firewall-cmd --list-ports确认端口状态，未开放则执行firewall-cmd --add-port=9200/tcp --permanent，再执行firewall-cmd --reload生效。
  • 若用ufw：执行ufw status查看规则，未开放则执行ufw allow 9200/tcp。

• 云安全组配置检查
  若为云服务器，登录云平台控制台，检查对应实例的安全组入站规则，确认允许公网IP（或0.0.0.0/0用于测试）访问9200端口，这是公网无法访问的常见原因。

• 网络路由与NAT验证
  若实例通过NAT映射获取公网IP，检查NAT规则是否将公网9200端口正确映射到实例内网IP的9200端口。可在本地用traceroute <publicip>或mtr <publicip>排查链路是否存在阻断或丢包。

• Elasticsearch配置补全
  虽然配置中已设置network.host: 0.0.0.0，可明确添加http.port: 9200到配置文件，重启服务后测试。当前日志显示为7.17.6版本且Security已禁用，无需考虑HTTPS及认证影响。

提供的配置文件 #

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
node.data : true
network.host : 0.0.0.0
discovery.seed_hosts : []
cluster.initial_master_nodes : [10.50.11.77]

关键日志片段 #

集群健康状态日志 #

tail -f /var/log/elasticsearch/elasticsearch.log

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]

at java.lang.Thread.run(Thread.java:833) [?:?]

[2022-10-05T23:50:13,021][INFO ][o.e.i.g.DatabaseNodeService] [ip-10-50-11-77] retrieve geoip database [GeoLite2-Country.mmdb] from [.geoip_databases] to [/tmp/geoip-databases/vr34RjMDQHGmLx60I5HrCw/GeoLite2-Country.mmdb.tmp.gz]

[2022-10-05T23:50:13,031][INFO ][o.e.i.g.DatabaseNodeService] [ip-10-50-11-77] retrieve geoip database [GeoLite2-ASN.mmdb] from [.geoip_databases] to [/tmp/geoip-databases/vr34RjMDQHGmLx60I5HrCw/GeoLite2-ASN.mmdb.tmp.gz]

[2022-10-05T23:50:13,038][INFO ][o.e.i.g.DatabaseNodeService] [ip-10-50-11-77] retrieve geoip database [GeoLite2-City.mmdb] from [.geoip_databases] to [/tmp/geoip-databases/vr34RjMDQHGmLx60I5HrCw/GeoLite2-City.mmdb.tmp.gz]

[2022-10-05T23:50:13,234][INFO ][o.e.c.r.a.AllocationService] [ip-10-50-11-77] Cluster health status changed from [RED] to [GREEN] (reason: [shards started [[.ds-.logs-deprecation.elasticsearch-default-2022.10.05-000001][0]]]).

[2022-10-05T23:50:13,771][INFO ][o.e.i.g.DatabaseNodeService] [ip-10-50-11-77] successfully reloaded changed geoip database file [/tmp/geoip-databases/vr34RjMDQHGmLx60I5HrCw/GeoLite2-Country.mmdb]

[2022-10-05T23:50:13,906][INFO ][o.e.i.g.DatabaseNodeService] [ip-10-50-11-77] successfully reloaded changed geoip database file [/tmp/geoip-databases/vr34RjMDQHGmLx60I5HrCw/GeoLite2-ASN.mmdb]

[2022-10-05T23:50:14,877][INFO ][o.e.i.g.DatabaseNodeService] [ip-10-50-11-77] successfully reloaded changed geoip database file [/tmp/geoip-databases/vr34RjMDQHGmLx60I5HrCw/GeoLite2-City.mmdb]

核心启动日志 #

[2022-10-06T02:57:20,690][INFO ][o.e.n.Node               ] [ip-10-50-11-77] node name [ip-10-50-11-77], node ID [vr34RjMDQHGmLx60I5HrCw], cluster name [elasticsearch], roles [transform, data_frozen, master, remote_cluster_client, data, ml, data_content, data_hot, data>
[2022-10-06T02:57:38,828][INFO ][o.e.t.TransportService   ] [ip-10-50-11-77] publish_address {10.50.11.77:9300}, bound_addresses {0.0.0.0:9300}
[2022-10-06T02:57:40,237][INFO ][o.e.h.AbstractHttpServerTransport] [ip-10-50-11-77] publish_address {10.50.11.77:9200}, bound_addresses {0.0.0.0:9200}
[2022-10-06T02:57:40,237][INFO ][o.e.n.Node               ] [ip-10-50-11-77] started
[2022-10-06T02:57:40,891][INFO ][o.e.x.s.s.SecurityStatusChangeListener] [ip-10-50-11-77] Active license is now [BASIC]; Security is disabled
[2022-10-06T02:57:42,827][INFO ][o.e.c.r.a.AllocationService] [ip-10-50-11-77] Cluster health status changed from [RED] to [GREEN] (reason: [shards started [[.ds-.logs-deprecation.elasticsearch-default-2022.10.05-000001][0]]]).

内容的提问来源于stack exchange，提问作者Didi