Essential Elasticsearch Commands (2026 Edition)

Elasticsearch is a core component of large architectures. Below is a detailed walkthrough of its essential commands.

1. Check Cluster Health

GET /_cluster/health

Use this as the first step for cluster troubleshooting.

2. List All Indices

GET /_cat/indices?v

Typical output shows health, status, index name, document count, store size, etc.

docs.count: document count

store.size: index size

health: health status

3. Create an Index

PUT /user

Specify the mapping:

{
  "mappings": {
    "properties": {
      "name": {"type": "text"},
      "age": {"type": "integer"}
    }
  }
}

4. Delete an Index

DELETE /user

Delete multiple indices: DELETE /user,order Warning: Do not run this in production without caution.

5. View Mapping (Field Structure)

GET /user/_mapping

Shows field types such as keyword, text, integer, date, boolean.

6. Insert Documents

With a specified ID:

POST /user/_doc/1
{
  "name": "Tom",
  "age": 20
}

Auto‑generated ID:

POST /user/_doc
{
  "name": "Jack",
  "age": 20
}

7. Query Documents

By ID: GET /user/_doc/1 All documents: GET /user/_search Result example shows total hits.

8. Update Documents

Partial update:

POST /user/_update/1
{
  "doc": {"age": 30}
}

Overwrite update:

PUT /user/_doc/1
{
  "name": "Tom",
  "age": 30
}

9. Delete Documents

By ID: DELETE /user/_doc/1 By query (e.g., name = "Tom"):

POST /user/_delete_by_query
{
  "query": {"match": {"name": "Tom"}}
}

10. Full‑Text Search (match)

GET /user/_search
{
  "query": {"match": {"name": "java"}}
}

Suitable for product, blog, or news search.

11. Exact Query (term)

GET /user/_search
{
  "query": {"term": {"status": 1}}
}

Applicable to ID, status, type, or keyword fields.

12. Pagination and Sorting

Pagination:

GET /user/_search
{
  "from": 0,
  "size": 10
}

Sorting:

GET /user/_search
{
  "sort": [{"age": "desc"}]
}

Combined pagination and sorting:

GET /user/_search
{
  "from": 20,
  "size": 10,
  "sort": [{"age": "desc"}]
}

Parameters:

from: start offset

size: number of results

13. Bulk Operations

Bulk insert (high‑performance):

POST /_bulk
{ "index": {"_index": "user", "_id": "1"} }
{ "name": "Tom", "age": 20 }
{ "index": {"_index": "user", "_id": "2"} }
{ "name": "Jack", "age": 25 }

Bulk delete:

POST /_bulk
{ "delete": {"_index": "user", "_id": "1"} }
{ "delete": {"_index": "user", "_id": "2"} }

Bulk update:

POST /_bulk
{ "update": {"_index": "user", "_id": "1"} }
{ "doc": {"age": 30} }

Bulk APIs are among the most important performance optimizations in Elasticsearch.