Essential Elasticsearch Commands: Complete Reference for Cluster Management & Data Operations

1. View Elasticsearch Cluster Information

Retrieve basic cluster details including Elasticsearch version, cluster name, Lucene version, and node information. This is the quickest way to verify that ES has started successfully. GET / Or via curl: curl -X GET "http://localhost:9200/" Elasticsearch version

Cluster name

Lucene version

Node information

Most commonly used for: Checking if ES is running normally.

2. Check Cluster Health Status

Monitor the overall health of the cluster. The key field is status which can be green, yellow, or red. GET /_cluster/health Example response:

{  "status": "green",  "number_of_nodes": 3,  "active_shards": 10}

Cluster status meanings:

green : All primary and replica shards are allocated.

yellow : All primary shards are allocated, but some replicas are missing.

red : At least one primary shard is unassigned, potentially affecting data access.

This command is critical for production troubleshooting.

3. List All Indices

View all indices with their health, status, document count, and storage size. GET /_cat/indices?v Or via curl:

curl -X GET "http://localhost:9200/_cat/indices?v"

Example output:

health status index    docs.count store.size green  open   user       1000000    2gb green  open   order      5000000    8gb yellow open   product    200000     500mb

Quickly reveals:

Index name

Document count

Primary shard status

Storage size

4. Create an Index

Simple creation (defaults to 1 shard, 1 replica): PUT /user With explicit shard and replica settings:

PUT /user{  "settings": {    "number_of_shards": 3,    "number_of_replicas": 1  }}

This creates 3 primary shards and 1 replica each, totaling 6 shards.

Important: The number of primary shards cannot be changed after index creation; plan carefully for production.

5. Delete an Index

Delete an index and all its data: DELETE /user Example deleting the order index: DELETE /order Response: { "acknowledged": true} ⚠️ Exercise extreme caution when running DELETE in production.

6. Add or Update Documents

Add a document with auto-generated ID:

POST /user/_doc/1{  "name": "张三",  "age": 28,  "job": "Java架构师"}

Add a document with a specific ID:

PUT /user/_doc/1001{  "name": "李四",  "age": 30}

If the ID already exists, the document is overwritten.

7. Query Documents

Retrieve a document by ID: GET /user/_doc/1001 Query all documents in an index: GET /user/_search Query with a match condition (core development command):

GET /user/_search{  "query": {    "match": {      "name": "张三"    }  }}

8. Delete Documents

Delete by ID: DELETE /user/_doc/1001 Delete by query (e.g., delete users older than 60):

POST /user/_delete_by_query{  "query": {    "range": {      "age": {        "gt": 60      }    }  }}

9. View Index Mapping

Mapping defines the schema (field types) similar to a database table structure plus field types. GET /user/_mapping Example mapping:

{  "properties": {    "name": {      "type": "text"    },    "age": {      "type": "integer"    },    "email": {      "type": "keyword"    }  }}

Common field types: text (full-text search) keyword (exact match, aggregations) integer,

long

date

boolean

nested

, object ES query performance and result accuracy heavily depend on mapping design.

10. Inspect Nodes and Cluster State

View node-level statistics: GET /_cat/nodes?v View shard allocation: GET /_cat/shards?v View cluster health (same as section 2): GET /_cluster/health Production troubleshooting workflow — combine commands to isolate issues: _cluster/health → Is the cluster abnormal? _cat/nodes → Which node is abnormal? _cat/indices → Which index is abnormal? _cat/shards → Which shard is abnormal?