Please do not (ever) expose elasticsearch without any authentication to anything else than localhost. This is a very dangerous thing as Elasticsearch hosts very sensitive user information.
If Elasticsearch runs on the same host this shouldn’t be needed at all. We need more input to understand your environment better.
