Elasticsearch port

[josmirpa]

Hi, I would like to know which port ElasticSearch communicates through as I need to query ElasticSearch from python.

Thanks!

[Ganesh-403]

@josmirpa
T-Pot's Elasticsearch service listens on the standard Elasticsearch port 9200 inside the container, but on the host it is mapped to port 64298.

The Docker Compose configuration maps it as:

127.0.0.1:64298 -> 9200

So:

• Inside the Docker network: http://elasticsearch:9200
• From the T-Pot host: http://127.0.0.1:64298 (or https://127.0.0.1:64298 depending on your version/security settings) :contentReference[oaicite:0]{index=0}

For example, in Python using the Elasticsearch client:

from elasticsearch import Elasticsearch

es = Elasticsearch(
    "http://127.0.0.1:64298"
)

print(es.info())

Or with curl:

curl http://127.0.0.1:64298

If security is enabled (which is the default in newer T-Pot releases), you'll need to authenticate:

from elasticsearch import Elasticsearch

es = Elasticsearch(
    "https://127.0.0.1:64298",
    basic_auth=("username", "password"),
    verify_certs=False,   # or provide the CA certificate
)

Without credentials, Elasticsearch will return a 401 Unauthorized, which is expected when security is enabled. :contentReference[oaicite:1]{index=1}

One thing to note is that port 64298 is bound to 127.0.0.1 by default, so it is not remotely accessible unless you intentionally change the Docker port binding or expose it through a reverse proxy/firewall. This is done to reduce the attack surface of the management services. :contentReference[oaicite:2]{index=2}

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.