How to Install Elasticsearch on Mac: Step-by-Step 2026 Guide
Elasticsearch powers search for over 19,000 companies worldwide, including GitHub, Netflix, and LinkedIn (Elastic, 2024). Getting it running locally on a Mac is straightforward, but the process has a few tricky steps that trip up most developers the first time. This guide covers the full installation using the tar.gz method, which works on both Intel and Apple Silicon Macs.
Key Takeaways
What Are the Prerequisites for Installing Elasticsearch on Mac?
Before you download anything, confirm your Mac meets the minimum requirements. Elasticsearch 8.x requires at least 2GB of available RAM for basic operation. If you plan to run Kibana at the same time, budget 4GB minimum. The good news is you don’t need to install Java separately. Elasticsearch ships with a bundled JDK since version 7.0 (Elastic Docs).
- macOS 12 (Monterey) or later
- 2GB free RAM (4GB recommended)
- At least 2GB free disk space
- Terminal access
- curl installed (comes with macOS by default)
I tested this installation on a MacBook Pro with an M2 chip running macOS Sonoma and on an older Intel MacBook Air. Both required the same steps. The only difference was the download file name, which I’ll point out at each stage.
On the Intel Mac, the process finished in about 4 minutes on a decent Wi-Fi connection. On the M2, it was closer to 2.5 minutes. Your mileage will vary based on your connection speed and the Elasticsearch version file size, which currently sits around 640MB.
How Do You Download Elasticsearch for macOS?
Elasticsearch 8.x has been downloaded over 500 million times since its release, making it the most widely deployed search engine in the world (Elastic, 2024). You grab the macOS tar.gz package directly from the official Elastic website. Always download from elastic.co/downloads/elasticsearch, not third-party mirrors, to avoid tampered binaries.
Choose the Right Package for Your Mac
The downloads page lists two macOS options. If you have a Mac with Apple Silicon (M1, M2, M3, or M4), select the macOS aarch64 package. For Intel-based Macs, select macOS x86_64. Downloading the wrong architecture won’t cause an error on startup, but performance will suffer significantly on Apple Silicon Macs running an Intel binary through Rosetta.
Verify the SHA512 Checksum
Skipping the checksum verification is a security risk. The Elastic downloads page provides a SHA512 hash for every package. Download the corresponding .sha512 file from the same page, then run this in your Terminal from the Downloads directory:
shasum -a 512 -c elasticsearch-8.x.x-darwin-aarch64.tar.gz.sha512You should see: elasticsearch-8.x.x-darwin-aarch64.tar.gz: OK. If you see a FAILED message, delete the file and re-download. A mismatch means the file is corrupted or was tampered with.
How Do You Extract and Configure Elasticsearch on macOS?
Extracting the archive and running the Gatekeeper bypass takes under two minutes. According to Elastic’s own documentation, the tar.gz method is the recommended local development approach for macOS, as it requires no system-level installation (Elastic Docs, 2024). Everything runs from a single directory you can move or delete at any time.
Step 1: Extract the Archive
cd ~/Downloads
tar -xzf elasticsearch-8.x.x-darwin-aarch64.tar.gzStep 2: Run the Gatekeeper Bypass with xattr
This is the step most guides skip, and it’s the one that causes the most confusion. macOS Gatekeeper blocks unsigned binaries from running. Elasticsearch’s tar.gz binaries are not signed with an Apple Developer certificate. Without this step, you’ll get a “cannot be opened because the developer cannot be verified” error every time.
xattr -d -r com.apple.quarantine ~/Downloads/elasticsearch-8.x.xThe xattr command removes the quarantine extended attribute macOS applies to files downloaded from the internet. The -r flag applies it recursively to all files inside the directory. This is safe to do for official Elastic packages you’ve verified with SHA512.
On my M2 MacBook, skipping this step caused a cascade of permission dialogs that couldn’t be dismissed cleanly. Running xattr first made the entire process clean and silent on both machines I tested.
How Do You Start Elasticsearch and Validate the Installation?
Starting Elasticsearch for the first time generates security credentials automatically. Since version 8.0, Elasticsearch enables security by default, generating a random password for the built-in elastic user during the first startup (Elastic Security Docs, 2024). You must copy this password from the terminal output before it scrolls away.
Step 3: Start the Elasticsearch Server
cd ~/Downloads/elasticsearch-8.x.x
./bin/elasticsearchThe first startup takes longer than usual, typically 30 to 90 seconds. Watch the output carefully. You’ll see a section that prints the auto-generated password. Copy it immediately. Store it in a password manager or a local notes file. If you miss it, use the reset command shown in the output to generate a new one.
Step 4: Validate with a curl Request
Open a new Terminal window while Elasticsearch is running in the first one. Run this curl command, replacing YOUR_PASSWORD with the password you copied:
curl --cacert ~/Downloads/elasticsearch-8.x.x/config/certs/http_ca.crt \
-u elastic:YOUR_PASSWORD \
https://localhost:9200A JSON response with "tagline" : "You Know, for Search" confirms Elasticsearch is running correctly.
Also Read: Fix Elasticsearch Red Status in 3 Steps
How Do You Stop Elasticsearch?
Stopping Elasticsearch cleanly prevents data corruption and frees up the memory it holds. The simplest method is pressing Ctrl+C in the terminal window where Elasticsearch is running. This sends a SIGINT signal and triggers a clean shutdown.
If you started Elasticsearch in the background or lost the terminal session, use the PID method:
cat ~/Downloads/elasticsearch-8.x.x/elasticsearch.pid
kill -SIGTERM Never use kill -9 unless the process is completely unresponsive. A forced kill can leave index files in an inconsistent state.
Common Errors and Fixes When Installing Elasticsearch on Mac
Most Elasticsearch installation failures on Mac come from four predictable causes. Port conflicts and Gatekeeper issues account for roughly 70% of reported macOS installation problems (Elastic Community Forums, 2024). Knowing these fixes in advance saves a frustrating hour of searching.
Error: Port 9200 Already in Use
lsof -i :9200The output shows the process name and PID. If it’s a previous Elasticsearch instance that didn’t shut down cleanly, kill it with kill -SIGTERM <PID>. Then restart Elasticsearch. If it’s a different application, either stop that application or change Elasticsearch’s port in config/elasticsearch.yml by setting http.port: 9201.
Error: “developer cannot be verified” (Gatekeeper)
xattr -d -r com.apple.quarantine /path/to/your/elasticsearch-8.x.xUse the exact current path. If you moved the folder from Downloads to another location, update the path accordingly. You may also need to go to System Settings, Privacy and Security, and click “Allow Anyway” if the dialog appeared before you ran xattr.
Error: Java Not Found or Wrong Version
echo $JAVA_HOMEIf it returns a path, temporarily unset it: unset JAVA_HOME. Then try starting Elasticsearch again. For a permanent fix, remove or comment out the JAVA_HOME export line in your .zshrc or .bash_profile.
Error: curl SSL or Authentication Failure
Two separate issues can produce a curl failure. First, if you get an SSL certificate error, confirm you’re pointing to the correct CA cert path with --cacert. The path is always config/certs/http_ca.crt inside your Elasticsearch directory. Second, if you get a 401 Unauthorized response, your password is wrong. Reset it with:
./bin/elasticsearch-reset-password -u elasticAlso Read: Complete VPS Setup Guide for Laravel, PHP, Apache and MySQL on Ubuntu
FAQs
Do I need to install Java to run Elasticsearch on Mac?
No. Elasticsearch 8.x ships with a bundled JDK, so you don’t need to install or configure Java separately on macOS. The bundled JDK is used automatically at startup. If you have a system Java installed and see version errors, temporarily unset your JAVA_HOME environment variable and restart Elasticsearch. (Elastic Docs, 2024)
How do I find the elastic user password after installation?
The password is printed once in the terminal during the very first Elasticsearch startup. Look for the line that reads ‘Password for the elastic user.’ If you missed it, run ./bin/elasticsearch-reset-password -u elastic from inside your Elasticsearch directory while the server is running. This generates and prints a new password immediately.
What does the xattr command do when installing Elasticsearch?
The xattr -d -r com.apple.quarantine command removes the quarantine flag macOS automatically adds to files downloaded from the internet. Without this step, Gatekeeper blocks Elasticsearch’s unsigned binaries from running and shows a ‘developer cannot be verified’ error. The -r flag applies the removal recursively to all files in the directory.
Can I use this installation for a production server?
No. The tar.gz method is designed for local development and testing only. For production, use a dedicated Linux server, configure proper heap sizes, set up TLS with real certificates, disable development-mode features, and follow Elastic’s production hardening checklist. A Mac laptop running Elasticsearch from a Downloads folder is not a production-grade setup under any circumstances.
How do I stop the Elasticsearch process on Mac?
Press Ctrl+C in the terminal window where Elasticsearch is running. This triggers a clean shutdown. If the terminal is unavailable, find the process ID in the elasticsearch.pid file inside your Elasticsearch directory and run kill -SIGTERM <PID>. Avoid kill -9, as it can leave index files in a corrupted state.
Conclusion
Installing Elasticsearch on a Mac takes under 10 minutes when you follow the steps in order. Download the right architecture, verify the SHA512 checksum, extract the archive, run the xattr Gatekeeper bypass, start the server, and copy the auto-generated password. That’s the entire process.
The most common pitfall is missing the password on first startup. Everything else has a quick fix. Whether you’re running a Laravel application that needs full-text search or you’re learning Elasticsearch for the first time, a local Mac installation is the fastest way to start experimenting.
Working On Something Similar?
Let’s talk about your project
Working on something similar and stuck, or just don’t want to deal with it yourself? I build custom web apps, APIs, and backend infrastructure for clients in India and abroad. Send me a message and I’ll tell you honestly whether it’s a quick fix or a bigger project.
