ulimit needs to be set every time before starting the process. So typically this is set in the init script. If you modify the Elasticsearch init script and add ulimit -a do you see this being set? If not then you should either modify /etc/sysconfig/elasticsearch if you're using the RPM. Or use /etc/security/limits.conf to modify this value.