Master Elasticsearch: From Quick Start to Advanced Index Management and Mapping

1. Quick Start

Check cluster health and nodes using GET http://localhost:9200/_cat/health?v and GET http://localhost:9200/_cat/?v. The response colors indicate Green (healthy), Yellow (some replicas unassigned), Red (data unavailable).

List all indices: GET http://localhost:9200/_cat/indices?v.

Create an index named customer with pretty output: PUT /customer?pretty.

Index a document:

curl -X PUT "localhost:9200/customer/_doc/1?pretty" -H 'Content-Type: application/json' -d'{ "name": "John Doe" }'

Retrieve the document:

curl -X GET "localhost:9200/customer/_doc/1?pretty"

Search all documents:

GET /customer/_search?q=*&sort=name:asc&pretty

JSON body version:

GET /customer/_search
{
  "query": { "match_all": {} },
  "sort": [{ "name": "asc" }]
}

2. Index Management

Create an index twitter with 3 primary shards and 2 replicas:

PUT twitter
{
  "settings": {
    "index": {
      "number_of_shards": 3,
      "number_of_replicas": 2
    }
  }
}

Define mappings, aliases, and view index settings, mappings, and health using the appropriate GET APIs.

Delete an index: DELETE /twitter Check existence with HEAD twitter (200 = exists, 404 = not).

Update settings (e.g., change replica count):

PUT /twitter/_settings
{
  "index": {
    "number_of_replicas": 2
  }
}

Set index read‑only or block writes using index.blocks.* settings, for example:

PUT /twitter/_settings
{
  "index": {
    "blocks.write": true
  }
}

Create and manage index templates:

PUT _template/template_1
{
  "index_patterns": ["te*", "bar*"],
  "settings": { "number_of_shards": 1 },
  "mappings": {
    "type1": {
      "_source": { "enabled": false },
      "properties": {
        "host_name": { "type": "keyword" },
        "created_at": { "type": "date", "format": "EEE MMM dd HH:mm:ss Z YYYY" }
      }
    }
  }
}

Open/close an index:

POST /my_index/_close
POST /my_index/_open

Shrink an index (requires all primary shards on one node and the source index set to read‑only):

PUT /my_source_index/_settings
{
  "settings": {
    "index.routing.allocation.require._name": "shrink_node_name",
    "index.blocks.write": true
  }
}
POST my_source_index/_shrink/my_target_index
{
  "settings": {
    "index.number_of_replicas": 1,
    "index.number_of_shards": 1,
    "index.codec": "best_compression"
  }
}

Split an index (requires index.number_of_routing_shards defined at creation):

PUT my_source_index
{
  "settings": {
    "index.number_of_shards": 1,
    "index.number_of_routing_shards": 2
  }
}
PUT /my_source_index/_settings
{
  "settings": { "index.blocks.write": true }
}
POST my_source_index/_split/my_target_index
{
  "settings": { "index.number_of_shards": 2 }
}

Rollover an alias when conditions are met (e.g., max age, max docs, max size):

PUT /logs-000001
{
  "aliases": { "logs_write": {} }
}
POST /logs_write/_rollover
{
  "conditions": {
    "max_age": "7d",
    "max_docs": 1000,
    "max_size": "5gb"
  }
}

Dry‑run rollover to test conditions without creating a new index:

POST /logs_write/_rollover?dry_run
{
  "conditions": {
    "max_age": "7d",
    "max_docs": 1000,
    "max_size": "5gb"
  }
}

Monitor index health, recovery, and shard stores with GET _cat/health, GET _cat/recovery?v, and GET _shard_stores APIs.

3. Mapping Details

Mapping defines field names, types, and properties. Example of creating a simple mapping for index test:

PUT test
{
  "mappings": {
    "type1": {
      "properties": {
        "field1": { "type": "text" }
      }
    }
  }
}

From Elasticsearch 7.x only a single mapping type _doc is allowed:

PUT twitter
{
  "mappings": {
    "_doc": {
      "properties": {
        "type": { "type": "keyword" },
        "name": { "type": "text" },
        "user_name": { "type": "keyword" },
        "email": { "type": "keyword" },
        "content": { "type": "text" },
        "tweeted_at": { "type": "date" }
      }
    }
  }
}

Core datatypes include text, keyword, numeric types ( long, integer, etc.), date, boolean, and binary. Complex types include object and nested. Geo types ( geo_point, geo_shape) and specialized types ( ip, completion, etc.) are also supported.

Multi‑field example to index a field both as analyzed text and as a keyword for sorting/aggregation:

PUT my_index
{
  "mappings": {
    "_doc": {
      "properties": {
        "city": {
          "type": "text",
          "fields": {
            "raw": { "type": "keyword" }
          }
        }
      }
    }
  }
}

Index documents and query using the multi‑field:

PUT my_index/_doc/1
{ "city": "New York" }
PUT my_index/_doc/2
{ "city": "York" }
GET my_index/_search
{
  "query": { "match": { "city": "york" } },
  "sort": { "city.raw": "asc" },
  "aggs": { "Cities": { "terms": { "field": "city.raw" } } }
}

Dynamic mapping automatically creates fields based on incoming JSON documents. Date detection is enabled by default with formats like strict_date_optional_time. Custom date formats or disabling detection can be configured in the index mapping.

Numeric detection can be turned on to treat numeric strings as numbers:

PUT my_index
{
  "mappings": {
    "_doc": {
      "numeric_detection": true
    }
  }
}
PUT my_index/_doc/1
{ "my_float": "1.0", "my_integer": "1" }