Elasticsearch server setup

Available on Enterprise and Enterprise Advanced plans

Elasticsearch allows you to search large volumes of data quickly, in near real-time, by creating and managing an index of post data. The indexing process can be managed from the System Console after setting up and connecting an Elasticsearch server. The post index is stored on the Elasticsearch server and updated constantly after new posts are made. In order to index existing posts, a bulk index of the entire post database must be generated.

Deploying Elasticsearch includes the following two steps: setting up Elasticsearch, and configuring Mattermost.

Set up Elasticsearch

We highly recommend that you set up Elasticsearch server on a dedicated machine separate from the Mattermost Server.

1. Download and install the latest release of Elasticsearch v9 or Elasticsearch v8. See the Elasticsearch documentation for installation details.
2. Set up Elasticsearch with systemd by running the following commands:

sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service

3. Confirm Elasticsearch is working on the server by running the following command:

curl localhost:9200

4. Get your network interface name by running the following command:

ip addr

5. Edit the Elasticsearch configuration file in vi by running the following command:

vi /etc/elasticsearch/elasticsearch.yml

6. In this file, replace the network.host value of _eth0_ with your network interface name, and save your changes.
7. Ensure you set action.destructive_requires_name to false in elasticsearch.yml to allow for wildcard operations to work.
8. Restart Elasticsearch by running the following commands:

sudo systemctl stop elasticsearch
sudo systemctl start elasticsearch

9. Confirm the ports are listenings by running the following command:

netstat -plnt

You should see the following ports, including the ones listening on ports 9200 and 9300. Confirm these are listening on your server's IP address.

10. Create an Elasticsearch directory and give it the proper permissions.
11. Install the icu-analyzer plugin to the /usr/share/elasticsearch/plugins directory by running the following command:

!Important

The analysis-icu plugin is required on every node in the cluster, not optional. Mattermost's post and file index templates depend on it. Without the plugin, Mattermost cannot create these templates.

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install analysis-icu

Restart Elasticsearch on each node to load the newly installed plugin before verifying it; _cat/plugins only reports active plugins, so a restart is required first. For production clusters, restart nodes one at a time (rolling restart) rather than all at once. Confirm the plugin is installed and active on every node before continuing. Replace <your-elasticsearch-host> and <password>, and update the CA path if needed:

curl --silent --show-error --fail-with-body --cacert /etc/elasticsearch/certs/http_ca.crt --user 'elastic:<password>' 'https://<your-elasticsearch-host>:9200/_cat/plugins?v&h=name,component,version&s=name,component'

Running this command should show analysis-icu once per node in the cluster. If the analysis-icu line is missing for any node, the plugin is not installed there. Use plain HTTP without credentials only for a cluster where Elasticsearch security has been explicitly disabled.

(Optional) CJK language analyzer plugins: To improve search for Korean, Japanese, or Chinese content, install one or more of the following language-specific analyzer plugins: analysis-nori (Korean), analysis-kuromoji (Japanese), and analysis-smartcn (Chinese).

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install analysis-nori
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install analysis-kuromoji
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install analysis-smartcn

After installing the CJK plugins, restart Elasticsearch to load them:

sudo systemctl restart elasticsearch

Then enable the EnableCJKAnalyzers configuration setting. See Enabling Chinese, Japanese, and Korean Search for additional CJK search configuration options.

Important

If you enable CJK analyzers on a server with existing indexed content, you must purge and rebuild the search index in System Console > Environment > Elasticsearch for the CJK analyzers to take effect on existing posts.

12. Test the connection from Mattermost to Elasticsearch by running the following command:

curl 172.31.80.220:9200

Configure Mattermost

Follow these steps to configure Mattermost to use your Elasticsearch server and to generate the post index:

1. Go to System Console > Environment > Elasticsearch.
2. Set Enable Elasticsearch Indexing to true to enable the other the settings on the page. Once the configuration is saved, new posts made to the database are automatically indexed on the Elasticsearch server.
3. Ensure Backend type is set to elasticsearch.

1. (Optional) Enter Server Username used to access the enterprise search server.
2. (Optional) Enter Server Password associated with the username.
3. Set Enable Cluster Sniffing (Optional). Sniffing finds and connects to all data nodes in your cluster automatically.

!Warning

Do not enable cluster sniffing when using cloud-hosted search providers such as Elastic Cloud or Amazon OpenSearch Service. Cloud providers typically hide search cluster nodes behind a proxy, so sniffed node addresses may be unreachable from your network. The provider handles connection pooling for you, making sniffing unnecessary and potentially disruptive.

4. Optional CA and client certificate configuration settings are available for use with basic authentication credentials or to replace them. See the Enterprise search configuration settings documentation for details.
5. Select Test Connection and then select Save. If the server connection is unsuccessful you won't be able to save the configuration or enable searching with Elasticsearch or AWS OpenSearch.

iNote

From Mattermost v11, enterprise search server connections are tested during Support Packet generation. Any connection errors encountered during Support Packet generation are automatically included in the packet to help diagnose configuration issues.

Build the post index of existing messages

Select Index Now. This process can take up to a few hours depending on the size of the post database and number of messages. The progress percentage can be seen as the index is created. To avoid downtime, set Enable Elasticsearch for search queries to false so that database search is available during the indexing process.

Enable enterprise search

Ensure bulk indexing is complete before enabling enterprise search, otherwise search results will be incomplete.

Set Enable Elasticsearch for search queries to true, and setting Enable Elasticsearch for autocomplete to true. Save your configuration updates and restart the Mattermost server.

iNote

For high post volume deployments, we strongly encourage you to read and properly configure the Mattermost LiveIndexingBatchSize configuration setting.

!Warning

For high post volume deployments, we also strongly recommend disabling Database Search once Elasticsearch or AWS OpenSearch is fully configured and running. The Mattermost Server will fall back on Database search if Elasticsearch or OpenSearch are unavailable, which can lead to performance degradation on high post volume deployments. From Mattermost v11.7, the server proactively detects outages through periodic health checks and falls back to database search on the first health check failure, rather than waiting for requests to time out. See the outage handling FAQ for details.

Once the configuration is saved, new posts made to the database are automatically indexed on the Elasticsearch or AWS OpenSearch server.

Enterprise search limitations

1. Elasticsearch and AWS OpenSearch use a standard selection of "stop words" to keep search results relevant. Results for the following words will not be returned: "a", "an", "and", "are", "as", "at", "be", "but", "by", "for", "if", "in", "into", "is", "it", "no", "not", "of", "on", "or", "such", "that", "the", "their", "then", "there", "these", "they", "this", "to", "was", "will", and "with".
2. Searching stop words in quotes returns more results than just the searched terms (ticket).
3. By default, search results are limited to a user's team and channel membership. This is enforced by the Mattermost server. The entities are indexed in Elasticsearch or AWS OpenSearch in a way that allows Mattermost to filter them when querying, so the Mattermost server narrows down the results on every Elasticsearch or AWS OpenSearch request applying those filters. From Mattermost v11.6, admins can allow searching public channels without membership so that users can find messages in public channels they haven't joined, scoped to teams they belong to.
4. User search and autocomplete served by Elasticsearch or AWS OpenSearch match on username, nickname, and first and last name only. Email addresses aren't indexed, so no user can be found by email address, including system admins. User searches served from the database continue to match on email address. For channel and team member searches, system admins always match on email address, and all other users also require Show email address to be enabled. The System Console > User Management > Users list always matches on email address, independently of that setting.