We had to add "elasticsearch - nofile 65536" into /etc/security/limits.conf for centos to fix issues we had.
https://www.elastic.co/guide/en/elasticsearch/reference/master/setting-system-settings.html
The session for elasticsearch user will only take the new setting on the next session so elasticsearch service restart will be required.
Also this thread After adding "elasticsearch - nofile 65536" still not enough threads are allocated
Says that need nproc not nofile but this conflicts with the documentation...