diff --git a/bundles/elasticsearch/files/elasticsearch.yml b/bundles/elasticsearch/files/elasticsearch.yml
new file mode 100644
index 0000000..a868c6f
--- /dev/null
+++ b/bundles/elasticsearch/files/elasticsearch.yml
@@ -0,0 +1,18 @@
+% if node.metadata.get('elasticsearch/cluster-name', None):
+cluster.name: ${node.metadata.get('elasticsearch/cluster-name')}
+% endif
+node.name: ${node.name}
+path.data: /var/lib/elasticsearch
+path.logs: /var/log/elasticsearch
+bootstrap.memory_lock: true
+
+
+# By default Elasticsearch is only accessible on localhost. Set a different
+# address here to expose this node on the network:
+#
+#network.host: 192.168.0.1
+#
+# By default Elasticsearch listens for HTTP traffic on the first free port it
+# finds starting at 9200. Set a specific HTTP port here:
+#
+http.port: 9200
diff --git a/bundles/elasticsearch/items.py b/bundles/elasticsearch/items.py
new file mode 100644
index 0000000..1239f5c
--- /dev/null
+++ b/bundles/elasticsearch/items.py
@@ -0,0 +1,17 @@
+files = {
+    '/etc/elasticsearch/elasticsearch.yml': {
+        'content_type': 'mako',
+        'triggers': {
+            'svc_systemd:elasticsearch:restart',
+        }
+    },
+}
+
+svc_systemd = {
+    'elasticsearch': {
+        'needs': {
+            'file:/etc/elasticsearch/elasticsearch.yml',
+            'pkg_apt:elasticsearch',
+        },
+    },
+}
diff --git a/bundles/elasticsearch/metadata.py b/bundles/elasticsearch/metadata.py
new file mode 100644
index 0000000..d4df1ec
--- /dev/null
+++ b/bundles/elasticsearch/metadata.py
@@ -0,0 +1,14 @@
+defaults = {
+    'apt': {
+        'repos': {
+            'elasticsearch': {
+                'items': {
+                    'deb https://artifacts.elastic.co/packages/7.x/apt stable main',
+                },
+            },
+        },
+        'packages': {
+            'elasticsearch': {},
+        },
+    },
+}
diff --git a/data/apt/files/gpg-keys/elasticsearch.asc b/data/apt/files/gpg-keys/elasticsearch.asc
new file mode 100644
index 0000000..1b50dcc
--- /dev/null
+++ b/data/apt/files/gpg-keys/elasticsearch.asc
@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.14 (GNU/Linux)
+
+mQENBFI3HsoBCADXDtbNJnxbPqB1vDNtCsqhe49vFYsZN9IOZsZXgp7aHjh6CJBD
+A+bGFOwyhbd7at35jQjWAw1O3cfYsKAmFy+Ar3LHCMkV3oZspJACTIgCrwnkic/9
+CUliQe324qvObU2QRtP4Fl0zWcfb/S8UYzWXWIFuJqMvE9MaRY1bwUBvzoqavLGZ
+j3SF1SPO+TB5QrHkrQHBsmX+Jda6d4Ylt8/t6CvMwgQNlrlzIO9WT+YN6zS+sqHd
+1YK/aY5qhoLNhp9G/HxhcSVCkLq8SStj1ZZ1S9juBPoXV1ZWNbxFNGwOh/NYGldD
+2kmBf3YgCqeLzHahsAEpvAm8TBa7Q9W21C8vABEBAAG0RUVsYXN0aWNzZWFyY2gg
+KEVsYXN0aWNzZWFyY2ggU2lnbmluZyBLZXkpIDxkZXZfb3BzQGVsYXN0aWNzZWFy
+Y2gub3JnPokBOAQTAQIAIgUCUjceygIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgEC
+F4AACgkQ0n1mbNiOQrRzjAgAlTUQ1mgo3nK6BGXbj4XAJvuZDG0HILiUt+pPnz75
+nsf0NWhqR4yGFlmpuctgCmTD+HzYtV9fp9qW/bwVuJCNtKXk3sdzYABY+Yl0Cez/
+7C2GuGCOlbn0luCNT9BxJnh4mC9h/cKI3y5jvZ7wavwe41teqG14V+EoFSn3NPKm
+TxcDTFrV7SmVPxCBcQze00cJhprKxkuZMPPVqpBS+JfDQtzUQD/LSFfhHj9eD+Xe
+8d7sw+XvxB2aN4gnTlRzjL1nTRp0h2/IOGkqYfIG9rWmSLNlxhB2t+c0RsjdGM4/
+eRlPWylFbVMc5pmDpItrkWSnzBfkmXL3vO2X3WvwmSFiQbkBDQRSNx7KAQgA5JUl
+zcMW5/cuyZR8alSacKqhSbvoSqqbzHKcUQZmlzNMKGTABFG1yRx9r+wa/fvqP6OT
+RzRDvVS/cycws8YX7Ddum7x8uI95b9ye1/Xy5noPEm8cD+hplnpU+PBQZJ5XJ2I+
+1l9Nixx47wPGXeClLqcdn0ayd+v+Rwf3/XUJrvccG2YZUiQ4jWZkoxsA07xx7Bj+
+Lt8/FKG7sHRFvePFU0ZS6JFx9GJqjSBbHRRkam+4emW3uWgVfZxuwcUCn1ayNgRt
+KiFv9jQrg2TIWEvzYx9tywTCxc+FFMWAlbCzi+m4WD+QUWWfDQ009U/WM0ks0Kww
+EwSk/UDuToxGnKU2dQARAQABiQEfBBgBAgAJBQJSNx7KAhsMAAoJENJ9ZmzYjkK0
+c3MIAIE9hAR20mqJWLcsxLtrRs6uNF1VrpB+4n/55QU7oxA1iVBO6IFu4qgsF12J
+TavnJ5MLaETlggXY+zDef9syTPXoQctpzcaNVDmedwo1SiL03uMoblOvWpMR/Y0j
+6rm7IgrMWUDXDPvoPGjMl2q1iTeyHkMZEyUJ8SKsaHh4jV9wp9KmC8C+9CwMukL7
+vM5w8cgvJoAwsp3Fn59AxWthN3XJYcnMfStkIuWgR7U2r+a210W6vnUxU4oN0PmM
+cursYPyeV0NX/KQeUeNMwGTFB6QHS/anRaGQewijkrYYoTNtfllxIu9XYmiBERQ/
+qPDlGRlOgVTd9xUfHFkzB52c70E=
+=92oX
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/nodes/qzwi.toml b/nodes/qzwi.toml
index c069cd9..08be668 100644
--- a/nodes/qzwi.toml
+++ b/nodes/qzwi.toml
@@ -1,6 +1,7 @@
 #hostname = "2a00:f820:528::4"
 hostname = "31.47.232.108"
 bundles = [
+  "elasticsearch",
   "ldap-frontend",
   "letsencrypt",
   "monit",
@@ -81,4 +82,4 @@ ram = 4
 from_address = "monit@qzwi.de"
 alert_addresses = [
   "rico@qzwi.de",
-]
\ No newline at end of file
+]