diff --git a/system/elasticsearch/client/single.yml b/system/elasticsearch/client/single.yml
new file mode 100644
index 0000000..8407e2d
--- /dev/null
+++ b/system/elasticsearch/client/single.yml
@@ -0,0 +1,8 @@
+classes:
+- service.elasticsearch.client
+parameters:
+  elasticsearch:
+    client:
+      enabled: true
+      server:
+        host: ${_param:stacklight_monitor_address}
diff --git a/system/elasticsearch/server/cluster.yml b/system/elasticsearch/server/cluster.yml
new file mode 100644
index 0000000..56a0469
--- /dev/null
+++ b/system/elasticsearch/server/cluster.yml
@@ -0,0 +1,78 @@
+classes:
+- service.elasticsearch.server.cluster
+- service.java.environment
+- service.glusterfs.server
+- service.glusterfs.client
+parameters:
+  _param:
+    java_environment_version: "8"
+    java_environment_platform: openjdk
+  linux:
+    system:
+      sysctl:
+        vm.max_map_count: 262144
+        vm.swappiness: 0
+      repo:
+        tcpcloud_elasticsearch:
+          source: "deb [arch=amd64] http://apt.tcpcloud.eu/nightly/ xenial elastic"
+          architectures: amd64
+          key_url: "http://apt.tcpcloud.eu/public.gpg"
+  java:
+    environment:
+      headless: true
+  elasticsearch:
+    server:
+      enabled: true
+      master: true
+      data: true
+      mlockall: true
+      bind:
+        address: ${_param:single_address}
+        port: 9200
+      index:
+        replicas: 2
+      threadpool:
+        bulk:
+         queue_size: 1000
+      gateway:
+        expected_nodes: 3
+        recover_after_nodes: 2
+        recover_after_time: 5m
+      cluster:
+        multicast: false
+        minimum_master_nodes: 2
+        members:
+        - host: ${_param:cluster_node01_address}
+        - host: ${_param:cluster_node02_address}
+        - host: ${_param:cluster_node03_address}
+      snapshot:
+        repo:
+          path: /var/lib/elasticsearch/repo
+  glusterfs:
+    server:
+      peers:
+        - ${_param:cluster_node01_address}
+        - ${_param:cluster_node02_address}
+        - ${_param:cluster_node03_address}
+      volumes:
+        elasticrepo:
+          storage: /srv/glusterfs/elasticrepo
+          replica: 3
+          bricks:
+            - ${_param:cluster_node01_address}:/srv/glusterfs/elasticrepo
+            - ${_param:cluster_node02_address}:/srv/glusterfs/elasticrepo
+            - ${_param:cluster_node03_address}:/srv/glusterfs/elasticrepo
+          options:
+            cluster.readdir-optimize: On
+            cluster.lookup-optimize: On
+            nfs.disable: On
+            network.remote-dio: On
+            diagnostics.client-log-level: WARNING
+            diagnostics.brick-log-level: WARNING
+    client:
+      volumes:
+        elasticrepo:
+          path: /var/lib/elasticsearch/repo
+          server: ${_param:cluster_node01_address}
+          user: elasticsearch
+          group: elasticsearch
diff --git a/system/elasticsearch/server/curator.yml b/system/elasticsearch/server/curator.yml
new file mode 100644
index 0000000..c0e9300
--- /dev/null
+++ b/system/elasticsearch/server/curator.yml
@@ -0,0 +1,87 @@
+parameters:
+  elasticsearch:
+    server:
+      curator:
+        timeout: 900
+        logfile: /var/log/elasticsearch/curator.log
+        logformat: json
+        actions:
+          - action: delete_indices
+            description: >-
+              Delete indices older than month (based on index name).
+              Ignore the error if the filter does not result in an actionable
+              list of indices (ignore_empty_list) and exit cleanly.
+            options:
+              ignore_empty_list: True
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: 'netflow\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: name
+                direction: older
+                timestring: '%Y.%m.%d'
+                unit: days
+                unit_count: 30
+          - action: delete_indices
+            description: >-
+              Delete indices older than 6 months (based on index name).
+              Ignore the error if the filter does not result in an actionable
+              list of indices (ignore_empty_list) and exit cleanly.
+            options:
+              ignore_empty_list: True
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: name
+                direction: older
+                timestring: '%Y.%m.%d'
+                unit: days
+                unit_count: 180
+          - action: replicas
+            description: >-
+              Reduce the replica count to 0 for indices older than 60 days
+              (based on index creation_date)
+            options:
+              count: 0
+              wait_for_completion: False
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: creation_date
+                direction: older
+                unit: days
+                unit_count: 90
+          - action: forcemerge
+            description: >-
+              forceMerge indices older than 2 days (based on index
+              creation_date) to 2 segments per shard.  Delay 120 seconds
+              between each forceMerge operation to allow the cluster to
+              quiesce.
+              This action will ignore indices already forceMerged to the same
+              or fewer number of segments per shard, so the 'forcemerged'
+              filter is unneeded.
+            options:
+              max_num_segments: 2
+              delay: 120
+              continue_if_exception: False
+              disable_action: False
+            filters:
+              - filtertype: pattern
+                kind: regex
+                value: '.*\-\d\d\d\d\.\d\d\.\d\d$'
+              - filtertype: age
+                source: creation_date
+                direction: older
+                unit: days
+                unit_count: 2
diff --git a/system/elasticsearch/server/single.yml b/system/elasticsearch/server/single.yml
new file mode 100644
index 0000000..d5c0538
--- /dev/null
+++ b/system/elasticsearch/server/single.yml
@@ -0,0 +1,59 @@
+classes:
+- service.java.environment.openjdk8
+- service.elasticsearch.server.single
+parameters:
+  linux:
+    system:
+      sysctl:
+        vm.max_map_count: 262144
+        vm.swappiness: 0
+      repo:
+        tcpcloud_elasticsearch:
+          source: "deb [arch=amd64] http://apt.tcpcloud.eu/nightly/ xenial elastic"
+          architectures: amd64
+          key_url: "http://apt.tcpcloud.eu/public.gpg"
+  java:
+    environment:
+      headless: true
+  elasticsearch:
+    server:
+      enabled: true
+      bind:
+        address: ${_param:single_address}
+        port: 9200
+      mlockall: true
+      threadpool:
+        bulk:
+          queue_size: 1000
+      gateway:
+        expected_nodes: 1
+        recover_after_nodes: 1
+        recover_after_time: 5m
+      cluster:
+        multicast: false
+        minimum_master_nodes: 1
+        members:
+        - host: ${_param:cluster_node01_address}
+      curator:
+        timeout: 30
+        logfile: /var/log/elasticsearch/curator.log
+        logformat: default
+        loglevel: INFO
+        actions:
+        - action: delete_indices
+          description: >-
+            Delete indices older than 31 days (based on index name).
+          options:
+            ignore_empty_list: True
+            continue_if_exception: False
+            disable_action: False
+          filters:
+          - filtertype: pattern
+            kind: regex
+            value: "^log|notification-.*$"
+          - filtertype: age
+            source: name
+            direction: older
+            timestring: '%Y.%m.%d'
+            unit: days
+            unit_count: 31