The REST API for Elasticsearch and OpenSearch, used for search and for log analytics. Everything is an HTTP request, which makes it easy to work with and equally easy to query from anywhere that can reach the port.
For years it shipped with no authentication whatsoever, and exposed clusters have been responsible for some of the largest data leaks on record. Never expose it directly; put authentication in front of it.
An exposed Elasticsearch cluster should be assumed to have been read already. Close it, put authentication in front of it, and review which indices were reachable.
The port scanner will tell you whether 9200 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.