Elasticsearch Cheatsheet - Command Reference
For operators and search engineers who must keep a cluster green and answer "why is this index slow or unassigned". The hard part is interpreting health, what drives shard relocation, and ILM policy trade-offs. By the end you can check cluster status, find and diagnose red/unassigned shards, manage index aliases and lifecycle, issue term/range/multi-search queries, and trace slow queries and disk pressure.
Cluster Status 6
curl localhost:9200/_cluster/health?prettyShow green/yellow/red status and shard counts
curl localhost:9200/_cat/nodes?vShow node roles, disk and load
curl localhost:9200/_cat/health?vCluster health overview (monitored often)
curl localhost:9200/_cluster/stats?prettySummary of indices, docs, shards
curl localhost:9200/_cat/allocation?vDisk & shard allocation per node (watermark alarms)
curl localhost:9200/_cat/master?vShow current master node (check first on split-brain)
Shard & Index 6
curl localhost:9200/_cat/indices?vList all indices with health, docs, size
curl localhost:9200/_cat/shards?v&h=index,shard,prirep,state,node,unassigned.reasonShow shard distribution and unassigned reason
curl localhost:9200/_cluster/allocation/explain?prettyExplain why a shard is unassigned (RED debugging)
curl -XDELETE localhost:9200/<index>Delete index (confirm name first)
curl localhost:9200/_ilm/explain/<index>?prettyShow ILM policy phase for an index
curl -XPUT localhost:9200/<index>/_settings -H "Content-Type:application/json" -d '{"number_of_replicas":1}'Dynamically change replica count (yellow fix)
Document CRUD 6
curl -XPOST localhost:9200/<index>/_doc -d '{"name":"tom"}' -H "Content-Type:application/json"Insert doc, auto-generate _id
curl -XPUT localhost:9200/<index>/_doc/1 -d '{"name":"tom"}' -H "Content-Type:application/json"Insert/overwrite doc with explicit _id
curl -XPOST localhost:9200/<index>/_update/1 -d '{"doc":{"age":20}}' -H "Content-Type:application/json"Partial update of a field
curl -XDELETE localhost:9200/<index>/_doc/1Delete one doc by _id
curl -XPOST localhost:9200/<index>/_bulk -d '{"index":{"_id":"1"}}
{"name":"a"}
' -H "Content-Type:application/x-ndjson"Bulk write, newline-delimited, far faster than single
curl localhost:9200/<index>/_doc/1?prettyGet doc by _id (add _source to see source only)
Search 6
curl localhost:9200/<index>/_search?q=name:tom&prettyURI simple query (quick verification)
curl localhost:9200/<index>/_search -d '{"query":{"match":{"name":"tom"}}}' -H "Content-Type:application/json"match full-text search (analyzes the query term)
curl localhost:9200/<index>/_search -d '{"query":{"term":{"status":"active"}}}' -H "Content-Type:application/json"term exact match (use term not match for keyword fields)
curl localhost:9200/<index>/_search -d '{"query":{"range":{"age":{"gte":18,"lte":30}}}}' -H "Content-Type:application/json"range query (gte/lte/gt/lt supported)
curl localhost:9200/<index>/_search -d '{"query":{"bool":{"must":[{"match":{"name":"tom"}}],"filter":[{"term":{"status":"active"}}]}}}' -H "Content-Type:application/json"bool compound query (filter is cached, faster)
curl localhost:9200/<index>/_search -d '{"query":{"match_all":{}},"sort":[{"created_at":"desc"}],"from":0,"size":10}' -H "Content-Type:application/json"Pagination+sort (deep pages: use search_after, not from+size)
Aggregation 5
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"by_status":{"terms":{"field":"status"}}}}' -H "Content-Type:application/json"terms group aggregation (size:0 hides docs)
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"avg_age":{"avg":{"field":"age"}}}}' -H "Content-Type:application/json"avg (also sum/max/min)
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"sales":{"date_histogram":{"field":"created_at","calendar_interval":"1d"}}}}' -H "Content-Type:application/json"Date histogram bucket (1d/1M/1y)
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"price_ranges":{"range":{"field":"price","ranges":[{"to":100},{"from":100,"to":500},{"from":500}]}}}}' -H "Content-Type:application/json"Numeric range bucket stats
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"users":{"cardinality":{"field":"user_id"}}}}' -H "Content-Type:application/json"cardinality distinct count (approx, HyperLogLog)
Query & Slowlog 5
curl localhost:9200/<index>/_count?prettyCount docs in an index
curl localhost:9200/_nodes/stats/thread_pool?prettyInspect thread-pool queue & rejected
curl localhost:9200/_nodes/stats/breaker?prettyCheck circuit breaker (large query failures)
tail -f /var/log/elasticsearch/*_index_search_slowlog.jsonFollow slow query log
curl localhost:9200/<index>/_settings?prettyShow index settings (replicas/shards)
Disk & Ops 6
curl localhost:9200/_cluster/settings?prettyShow cluster dynamic settings (disk watermarks)
curl -XPUT localhost:9200/_cluster/settings -H "Content-Type:application/json" -d '{"transient":{"cluster.routing.allocation.disk.watermark.low":"85%"}}'Temporarily adjust disk watermark (use with care)
curl -XPOST localhost:9200/_forcemerge?max_num_segments=1Force merge segments (lower disk for read-only index)
df -h /var/lib/elasticsearchCheck ES data disk usage (writes blocked past watermark)
curl -XPOST localhost:9200/<index>/_closeClose index to free resources; open to restore
curl -XPOST localhost:9200/<index>/_refreshManually refresh so recent writes are searchable
Tips
- Cluster red? First find unassigned shards with _cat/shards, then check reasons via allocation/explain — don't force allocation.
- Slow queries: first tell whether filters skip cache or aggregation cardinality is too high; use search_after instead of from+size for deep pagination.
- Disk over flood watermark rejects writes — clear cold indices or raise the watermark before adding nodes.
- Use match for full-text on text fields and term for exact on keyword fields; mixing them returns no results.
- Bulk writes via _bulk are an order of magnitude faster than per-doc _doc; set Content-Type to application/x-ndjson.
Official References
Each command links to its official documentation below, so you can verify the latest usage and read deeper.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Contact Us
Wrong command or description? Send us corrections, business inquiries or product feedback by email.
Contact Us