Why is port 9200 already in use on my Mac?

Almost always a running or improperly stopped Elasticsearch instance: either a local install, a Docker container, or one started by a tool like Logstash or an ELK stack setup you're testing.

Is it safe to kill a process on port 9200?

Yes, if it's a local Elasticsearch instance you control. Just be aware that a hard kill can leave an index in an inconsistent state if a write was in progress; stopping the service cleanly is preferable when possible.

Is port 9200 a security risk?

Elasticsearch has no authentication enabled by default in many setups, which has led to widely publicized data leaks when 9200 was exposed to the public internet. Locally for development it's fine; it should never be open to the internet without authentication configured.

Port 9200: Elasticsearch's Default Port Explained

Port 9200 belongs to Elasticsearch, and it’s one of the more common “why won’t this start” ports for anyone running a local search or logging stack.

What typically listens on port 9200

Elasticsearch: The default HTTP API port for queries, indexing, and cluster management.
Docker containers: A very common way to run Elasticsearch locally is via Docker, which maps its internal 9200 to your host’s 9200.
ELK/Elastic stack tooling: Kibana (usually on 5601) and Logstash both talk to Elasticsearch over this port, so a full local stack will have 9200 in use as a dependency even if you’re not interacting with it directly.

Is it safe to kill?

Yes, for a local development instance. A clean shutdown (stopping the Elasticsearch service or container rather than force-killing it) is better practice if you have data you care about, since an abrupt kill mid-write can occasionally leave an index needing recovery on next start. For a throwaway local dev instance, a hard kill is fine.

Is it suspicious?

Not on a machine you know is running a search stack. It becomes a real concern in a completely different context: Elasticsearch instances with no authentication enabled, exposed directly to the public internet on port 9200, have been the source of several large, well-documented data leaks over the years. That’s a server-exposure problem, not a local-development one. On your own Mac behind a router, an Elasticsearch instance on 9200 isn’t reachable from outside your network by default.

How to find and free port 9200 on macOS

lsof -i :9200

To stop it:

kill -9 $(lsof -ti :9200)

Or, if it’s a Docker container, docker stop the container rather than killing the process directly.

Portie shows exactly what’s bound to 9200, handy for confirming a stray Elasticsearch instance is actually the one you meant to stop, especially when you have more than one local project using it.