This page is a conglomeration of helpful Elasticsearch queries.

What to know before getting started:

• Clusters with HTTP: Run the curls as seen below.

• Clusters with HTTPS: Please run curls with authentication and https, -u elastic:YOUR-ELASTIC-USER-PASSWORD. E.g. curl -u elastic:HDw7aoiMzp_P https://127.0.0.1:443/_cluster/health?pretty

• AWS OpenSearch:

  • You’ll need the cluster endpoint for the ES “IP”.

  • The port will be 443.

• On-prem Elastic:

  • You’ll need the IP of your Elastic host. If you have multiple nodes, a single IP for a master-eligible node will work.

  • The port will be 9200.

Check Cluster Health

• Seeing the cluster health: curl http://ip_address:9200/_cluster/health?pretty

• Seeing the master node: curl http://ip_address:9200/_cat/master?v

List Indices Data

• To see generic index data: curl -XGET http://ip_address:9200/_cat/indices

• To see all index data: curl "http://ip_address:9200/_cat/indices?h=health,status,index,id,pri,rep,docs.count,docs.deleted,store.size,creation.date.string?v"

• Sum of doc count across all indices: curl "http://ip_address:9200/_cat/indices?h=i,dc" | grep diskover- | awk '{sum += $2} END {print sum}'

Delete Indices

• To delete a single index: curl -XDELETE http://ip_address:9200/diskover-YOUR-INDEX-NAME

Size Allocation

• Entire cluster: curl -XGET 'http://ip_address:9200/_cat/allocation?v'

• Per Index:

  • curl "http://ip_address:9200/_cat/indices?h=index,store.size&bytes=kb&format=json"

  • curl "http://ip_address:9200/_cat/shards?v"

• Per Index, Sort by Largest Index First: sort -k2 -h -r <<< "$(curl http://localhost:9200/_cat/indices?h=i,store.size)"

Refresh Interval -1 / Manual Refresh

curl -s http://ip_address:9200/diskover-YOUR-INDEX-NAME/_count?pretty
{
  "count" : 30359,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  }
}

curl -s http://ip_address:9200/diskover-YOUR-INDEX-NAME/_refresh
{
    "_shards": {
        "total": 1,
        "successful": 1,
        "failed": 0
    }
}

curl -s http://ip_address:9200/diskover-YOUR-INDEX-NAME/_count?pretty
{
  "count" : 2087776,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  }
}

Adjust Replicas of Existing Index

curl -XPUT "http://<elasticsearch_host>:9200/diskover-YOUR-INDEX-NAME/_settings" \
-H "Content-Type: application/json" \
-d '{
  "index": {
    "number_of_replicas": 0
  }
}'

Finding documents in the index with a specific field

curl -XGET "http://ip_address:9200/diskover-YOUR-INDEX-NAME/_search" -H "Content-Type: application/json" -d '{"query":{"exists":{"field":"mediainfo"}},"size":1000}' | jq

Narrowing down a search to sub-fields, e.g. mediainfo.resolution

curl -XGET "http://ip_address:9200/diskover-YOUR-INDEX-NAME/_search" -H "Content-Type: application/json" -d '{"query":{"exists":{"field":"mediainfo.resolution"}},"size":1000}' | jq