How to uninstall Elasticsearch on a linux server isn’t well documented. Here’s a clear set of instruction on how to do it.
Find Running Elasticsearch Instances
First confirm that Elasticsearch is not actively running.
Using curl
Check for a running server on the machine’s localhost with curl:
curl localhost:9200
If one is you’ll see a response containing elasticsearch.
Using ps
Check for a running server process using ps:
ps -ef | grep elas
If one exists you’ll see it returned, if you don’t see anything then no elasticsearch process is running.
Stop/Shutdown a Running Elasticsearch Process
On any modern Linux distribution Elasticsearch runs as a systemd service, so systemctl is the right tool to stop it and keep it from coming back on reboot:
sudo systemctl stop elasticsearch
sudo systemctl disable elasticsearch
sudo systemctl status elasticsearch
On older systems still using SysV init scripts, the service command does the same job:
sudo service elasticsearch status
sudo service elasticsearch stop
If the process was started manually rather than as a service, kill it directly:
pkill -f elasticsearch
One note if you find old tutorials referencing it: the curl -XPOST localhost:9200/_cluster/nodes/_shutdown API only exists in Elasticsearch 1.x. It was removed in version 2.0, so on anything remotely recent it returns an error. Use systemctl.
Back Up Before You Remove Anything
Uninstalling the package leaves your data on disk, but the purge steps below delete it permanently. If there’s any chance the indexes matter, copy the data directory somewhere safe first:
sudo tar -czf elasticsearch-data-backup.tar.gz /var/lib/elasticsearch
Uninstall Elasticsearch
Depending on how elasticsearch was installed, and what type of server you’re running, you’ll need to use one of the following approaches to uninstall it.
Apt
The apt-get command is usually found on Ubuntu, Debian, and related Linux distributions.
sudo apt-get remove elasticsearch
RPM
The rpm command is typically found on Red Hat linux machines like CentOS and Fedora.
rpm -e elasticsearch
YUM / DNF
The yum command exists on Red Hat linux machines using Red Hat Enterprise Linux RPM software packages. Newer Fedora, RHEL and CentOS Stream releases use dnf with identical syntax.
sudo yum remove elasticsearch
# or
sudo dnf remove elasticsearch
Purging an Elasticsearch Config
The final step to uninstall elasticsearch from a server is to clear out the leftover configuration files.
APT
sudo apt-get --purge autoremove elasticsearch
dpkg
sudo dpkg --purge elasticsearch
If you receive any errors and need to force the removal you can add a --force-all argument to the command:
sudo dpkg --purge --force-all elasticsearch
Final Step for a Clean Uninstall
The final step for a super clean uninstall is to manually remove the directories that are leftover on the system: data, config, logs, and the install itself.
sudo rm -rf /var/lib/elasticsearch/
sudo rm -rf /etc/elasticsearch
sudo rm -rf /var/log/elasticsearch
sudo rm -rf /usr/share/elasticsearch
You can also remove the service script, but the location will vary from server to server.
Remove the Elastic Package Repository
If Elasticsearch was installed from Elastic’s official repository, remove the repo definition too so future apt update or yum update runs stop fetching its metadata:
# Debian/Ubuntu
sudo rm -f /etc/apt/sources.list.d/elastic-*.list
sudo apt-get update
# RHEL/CentOS/Fedora
sudo rm -f /etc/yum.repos.d/elasticsearch.repo
Disclaimer
These steps may change over time, or may not work on your system. It’s important that you know what you’re doing and take full responsibility for the outcome of this process. I may no guarantee or warranty on any of this advice, use it at your own risk.