It happened again, but the memory usage on the server was only 36%. I tried using the command -jstat -gc but it would allow me to connect to the elastic process.
I'm not sure how to check the JVM heap size properly.
On another note, I found that Mavel was still running in the background. I previously uninstalled it because it was choking up my elastic search with heaps of logs. But I must not have uninstalled it correctly, it was logging massive amounts of errors.
I also tried to set mlockall=true, but found there was another setting in elasticsearch.service which needed to be changed for this to work.
Fingers crossed it doesn't happen again. This app is in production now, still not too many users, but I wouldn't want it to fail for them.