Way to stop the AWS Elasticsearch

You have covered the main ways to get a VPC instance in a private subnet to talk to the outside world.

1. Have the Internet traffic for the private subnet be routed out of a VPN tunnel connected to your office, which can then provide access to the rest of the internet. Not ideal since it requires an always on VPN tunnel and an extra hop through your office.

I would suggest using NAT instances, this is the recommended setup for getting Internet access to machines inside private subnets. They are configured per subnet, so your machines do not need to have any knowledge of their configuration when being launched. Just be sure to use an m1.large or larger instance to get the higher network throughput (vs m1.small)

I've discovered after much suffering that the best way to run elasticsearch on a single server is to change the default setting of:

index.number_of_replicas: 1

to

index.number_of_replicas: 0

If there are 0 replicas, elasticsearch will never try to assign shards to any other "replica" then itself, thereby removing the issue of unassigned shards and corrupted indices.

My full (stable) standalone, non-default elasticsearch config is:

node.max_local_storage_nodes: 1
index.number_of_replicas: 0

Note, this is a config for a log-reader setup only, not a full scale production setup.