Elasticsearch Cheatsheet - Command Reference
Elasticsearch 集群运维与开发必备命令都在这里了，从集群健康到分片排障，按场景分类整理，现场排障直接复制。
Back to SysOps集群状态 Cluster 6
curl localhost:9200/_cluster/health?pretty看集群 green/yellow/red 状态和分片数
curl localhost:9200/_cat/nodes?v查看节点角色、磁盘和负载
curl localhost:9200/_cat/health?v集群健康概览，监控常采
curl localhost:9200/_cluster/stats?pretty看索引数、文档数、分片数汇总
curl localhost:9200/_cat/allocation?v看各节点磁盘分片分配，水位线告警必看
curl localhost:9200/_cat/master?v查看当前主节点，脑裂排查先看
分片与索引 Shard & Index 6
curl localhost:9200/_cat/indices?v列出所有索引的健康、文档数和大小
curl localhost:9200/_cat/shards?v&h=index,shard,prirep,state,node,unassigned.reason看分片分布和未分配原因
curl localhost:9200/_cluster/allocation/explain?pretty解释分片为什么未分配，RED 排查必备
curl -XDELETE localhost:9200/<index>删除索引，释放磁盘前先确认名字
curl localhost:9200/_ilm/explain/<index>?pretty查看索引 ILM 策略执行阶段
curl -XPUT localhost:9200/<index>/_settings -H "Content-Type:application/json" -d '{"number_of_replicas":1}'动态调整副本数，yellow 排障常用
文档 CRUD 6
curl -XPOST localhost:9200/<index>/_doc -d '{"name":"tom"}' -H "Content-Type:application/json"插入文档，自动生成 _id
curl -XPUT localhost:9200/<index>/_doc/1 -d '{"name":"tom"}' -H "Content-Type:application/json"指定 _id 插入/覆盖文档
curl -XPOST localhost:9200/<index>/_update/1 -d '{"doc":{"age":20}}' -H "Content-Type:application/json"部分更新文档字段
curl -XDELETE localhost:9200/<index>/_doc/1按 _id 删除单条文档
curl -XPOST localhost:9200/<index>/_bulk -d '{"index":{"_id":"1"}}
{"name":"a"}
' -H "Content-Type:application/x-ndjson"批量写入，换行分隔，性能远高于单条
curl localhost:9200/<index>/_doc/1?pretty按 _id 获取文档，加 _source 只看原文
搜索查询 Search 6
curl localhost:9200/<index>/_search?q=name:tom&prettyURI 简单查询，快速验证用
curl localhost:9200/<index>/_search -d '{"query":{"match":{"name":"tom"}}}' -H "Content-Type:application/json"match 全文检索，会对查询词分词
curl localhost:9200/<index>/_search -d '{"query":{"term":{"status":"active"}}}' -H "Content-Type:application/json"term 精确匹配，keyword 字段用 term 不用 match
curl localhost:9200/<index>/_search -d '{"query":{"range":{"age":{"gte":18,"lte":30}}}}' -H "Content-Type:application/json"range 范围查询，支持 gte/lte/gt/lt
curl localhost:9200/<index>/_search -d '{"query":{"bool":{"must":[{"match":{"name":"tom"}}],"filter":[{"term":{"status":"active"}}]}}}' -H "Content-Type:application/json"bool 组合查询，filter 走缓存性能更好
curl localhost:9200/<index>/_search -d '{"query":{"match_all":{}},"sort":[{"created_at":"desc"}],"from":0,"size":10}' -H "Content-Type:application/json"分页+排序，深分页用 search_after 替代 from+size
聚合分析 Aggregation 5
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"by_status":{"terms":{"field":"status"}}}}' -H "Content-Type:application/json"terms 分组聚合，size:0 不返回文档只看统计
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"avg_age":{"avg":{"field":"age"}}}}' -H "Content-Type:application/json"avg 求平均值，类似还有 sum/max/min
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"sales":{"date_histogram":{"field":"created_at","calendar_interval":"1d"}}}}' -H "Content-Type:application/json"按日期分桶，calendar_interval 支持 1d/1M/1y
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"price_ranges":{"range":{"field":"price","ranges":[{"to":100},{"from":100,"to":500},{"from":500}]}}}}' -H "Content-Type:application/json"数值区间分桶统计
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"users":{"cardinality":{"field":"user_id"}}}}' -H "Content-Type:application/json"cardinality 去重计数，近似值（HyperLogLog）
查询与慢日志 Query & Slowlog 5
curl localhost:9200/<index>/_count?pretty统计索引文档数
curl localhost:9200/_nodes/stats/thread_pool?pretty看线程池 queue 和 rejected，排查拒绝请求
curl localhost:9200/_nodes/stats/breaker?pretty看熔断器触发情况，排查大查询失败
tail -f /var/log/elasticsearch/*_index_search_slowlog.json跟踪慢查询日志
curl localhost:9200/<index>/_settings?pretty查看索引设置，排查副本数和分片数
运维与磁盘 Disk & Ops 6
curl localhost:9200/_cluster/settings?pretty看集群动态设置，如磁盘水位线
curl -XPUT localhost:9200/_cluster/settings -H "Content-Type:application/json" -d '{"transient":{"cluster.routing.allocation.disk.watermark.low":"85%"}}'临时调整磁盘水位线，慎用
curl -XPOST localhost:9200/_forcemerge?max_num_segments=1强制合并段，降低只读索引磁盘占用
df -h /var/lib/elasticsearch看 ES 数据盘使用率，触发水位线会拒绝写入
curl -XPOST localhost:9200/<index>/_close关闭索引释放资源，再 open 恢复
curl -XPOST localhost:9200/<index>/_refresh手动刷新让最近写入可搜，写完立即查用
💡 Tips
- 集群变 red 先用 _cat/shards 找未分配分片，再用 allocation/explain 看原因，别急着强制分配。
- 查询变慢先区分是 filter 没走缓存还是聚合基数过高，深分页用 search_after 替代 from+size。
- 磁盘超 flood watermark 会拒绝写入，先清冷索引或调水位线，而不是直接加节点。
- text 字段用 match 做全文检索，keyword 字段用 term 精确匹配，混用会导致查不到结果。
- 批量写入用 _bulk 接口，比逐条 _doc 快一个数量级，注意 Content-Type 是 application/x-ndjson。