I have a ton of 9200 sessions running

Elastic Stack Elasticsearch
1

I have lots of these sessions running when I do a netstat -an | grep 9200

tcp 0 0 172.22.17.62:58500 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58525 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58489 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58522 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58606 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58605 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58620 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58556 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58583 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58524 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58558 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58533 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58501 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58590 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58518 172.22.17.62:9200 TIME_WAIT
tcp 0 0 172.22.17.62:58566 172.22.17.62:9200 TIME_WAIT

2

Interesting. Are you just telling us about this or do you want something more?

3

Is this normal? Is there a way I can eliminate them?

4

I have 5 times as many sessions as I listed above.

5

What is this host?

6

host IP of the ELK server

7

So you have LS talking to ES and KB talking to ES, all on the same host?
If so then that is what those connections would be.

8

thanks