connection refused deploying elasticsearch on kubernetes

Question

I'm trying to deploy elasticsearch on kubernetes. When I login to the docker container with kubectl exec -c elasticsearch -ti elasticsearch-0 -- bash and run curl localhost:9200 I get the expected response from elastic search:

{
  "name" : "elasticsearch-0",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "oUXVt_Z4ROG89ACF1jdTXw",
  "version" : {
    "number" : "7.17.3",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "5ad023604c8d7416c9eb6c0eadb62b14e766caff",
    "build_date" : "2022-04-19T08:11:19.070913226Z",
    "build_snapshot" : false,
    "lucene_version" : "8.11.1",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

but when i try to curl from elsewhere on my cluster, or the the exposed ingress IP address, I get a connection refused. I'm new to kubernetes so to see if I understood the setup correctly, I put an nginx container in the same pod and ran it on port 8080. When i curl nginx from the external IP i get a successful response so i'm not sure where i went wrong in my setup because they look the same. Here's my kubernetes manifest:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: elasticsearch
  labels:
    app: elasticsearch
spec:
  serviceName: elasticsearch
  replicas: 3
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      imagePullSecrets:
        - name: acr-secret
      nodeSelector:
        mylabel: hihi
      terminationGracePeriodSeconds: 30
      initContainers:
        - name: init-service
          image: ubuntu
          command: [ 'sysctl',  '-w', 'vm.max_map_count=262144']
          securityContext:
            privileged: true
        - name: init-permissions
          image: ubuntu
          command: ['chown', '-R', '1000:1000', '/usr/share/elasticsearch/data']
          securityContext:
            privileged: true
          volumeMounts:
          - name: esdata
            mountPath: /usr/share/elasticsearch/data

      containers:
      - name: nginx
        image: jamesesdocker.azurecr.io/nginxjames/latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
      - name: elasticsearch
        image: jamesesdocker.azurecr.io/es717/latest
        imagePullPolicy: Always
        ports:
        - containerPort: 9200
          name: es1
        - containerPort: 9300
          name: es2
        resources:
          limits:
            cpu: "500m"
            memory: 1Gi
          requests:
            cpu: "500m"
            memory: 1Gi
        securityContext:
          capabilities:
            add:
              - IPC_LOCK
        env:
          - name: MAX_HEAP_SIZE
            value: 512M
          - name: HEAP_NEWSIZE
            value: 100M
          - name: POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
        # These volume mounts are persistent. They are like inline claims,
        # but not exactly because the names need to match exactly one of
        # the stateful pod volumes.
        volumeMounts:
        - name: esdata
          mountPath: /usr/share/elasticsearch/data
  # These are converted to volume claims by the controller
  # and mounted at the paths mentioned above.
  # do not use these in production until ssd GCEPersistentDisk or other ssd pd
  volumeClaimTemplates:
  - metadata:
      name: esdata
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: elasticsearch
      resources:
        requests:
          storage: 2Gi
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: elasticsearch
provisioner: kubernetes.io/azure-disk
parameters:
  storageaccounttype: Standard_LRS
  kind: managed
  resourceGroup: james-elasticsearch
---
apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
spec:
  selector:
    app: elasticsearch
  ports:
    - protocol: TCP
      port: 9200
      name: elasticsearch
    - protocol: TCP
      port: 8080
      name: nginx
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - http:
      paths:
      - path: /es
        pathType: Prefix
        backend:
          service:
            name: elasticsearch
            port:
              number: 9200
      - path: /nginx
        pathType: Prefix
        backend:
          service:
            name: elasticsearch
            port:
              number: 8080
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  labels:
    app.kubernetes.io/component: controller
  name: nginx
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"
spec:
  controller: k8s.io/ingress-nginx