Elasticsearch Cheatsheet - Command Reference
All essential Elasticsearch commands organized by use case, with 40+ entries you can copy and run directly. Find the right command fast when you need it.
Back to SysOpsCluster Status 6
curl localhost:9200/_cluster/health?prettyShow green/yellow/red status and shard counts
curl localhost:9200/_cat/nodes?vShow node roles, disk and load
curl localhost:9200/_cat/health?vCluster health overview (monitored often)
curl localhost:9200/_cluster/stats?prettySummary of indices, docs, shards
curl localhost:9200/_cat/allocation?vDisk & shard allocation per node (watermark alarms)
curl localhost:9200/_cat/master?vShow current master node (check first on split-brain)
Shard & Index 6
curl localhost:9200/_cat/indices?vList all indices with health, docs, size
curl localhost:9200/_cat/shards?v&h=index,shard,prirep,state,node,unassigned.reasonShow shard distribution and unassigned reason
curl localhost:9200/_cluster/allocation/explain?prettyExplain why a shard is unassigned (RED debugging)
curl -XDELETE localhost:9200/<index>Delete index (confirm name first)
curl localhost:9200/_ilm/explain/<index>?prettyShow ILM policy phase for an index
curl -XPUT localhost:9200/<index>/_settings -H "Content-Type:application/json" -d '{"number_of_replicas":1}'Dynamically change replica count (yellow fix)
Document CRUD 6
curl -XPOST localhost:9200/<index>/_doc -d '{"name":"tom"}' -H "Content-Type:application/json"Insert doc, auto-generate _id
curl -XPUT localhost:9200/<index>/_doc/1 -d '{"name":"tom"}' -H "Content-Type:application/json"Insert/overwrite doc with explicit _id
curl -XPOST localhost:9200/<index>/_update/1 -d '{"doc":{"age":20}}' -H "Content-Type:application/json"Partial update of a field
curl -XDELETE localhost:9200/<index>/_doc/1Delete one doc by _id
curl -XPOST localhost:9200/<index>/_bulk -d '{"index":{"_id":"1"}}
{"name":"a"}
' -H "Content-Type:application/x-ndjson"Bulk write, newline-delimited, far faster than single
curl localhost:9200/<index>/_doc/1?prettyGet doc by _id (add _source to see source only)
Search 6
curl localhost:9200/<index>/_search?q=name:tom&prettyURI simple query (quick verification)
curl localhost:9200/<index>/_search -d '{"query":{"match":{"name":"tom"}}}' -H "Content-Type:application/json"match full-text search (analyzes the query term)
curl localhost:9200/<index>/_search -d '{"query":{"term":{"status":"active"}}}' -H "Content-Type:application/json"term exact match (use term not match for keyword fields)
curl localhost:9200/<index>/_search -d '{"query":{"range":{"age":{"gte":18,"lte":30}}}}' -H "Content-Type:application/json"range query (gte/lte/gt/lt supported)
curl localhost:9200/<index>/_search -d '{"query":{"bool":{"must":[{"match":{"name":"tom"}}],"filter":[{"term":{"status":"active"}}]}}}' -H "Content-Type:application/json"bool compound query (filter is cached, faster)
curl localhost:9200/<index>/_search -d '{"query":{"match_all":{}},"sort":[{"created_at":"desc"}],"from":0,"size":10}' -H "Content-Type:application/json"Pagination+sort (deep pages: use search_after, not from+size)
Aggregation 5
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"by_status":{"terms":{"field":"status"}}}}' -H "Content-Type:application/json"terms group aggregation (size:0 hides docs)
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"avg_age":{"avg":{"field":"age"}}}}' -H "Content-Type:application/json"avg (also sum/max/min)
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"sales":{"date_histogram":{"field":"created_at","calendar_interval":"1d"}}}}' -H "Content-Type:application/json"Date histogram bucket (1d/1M/1y)
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"price_ranges":{"range":{"field":"price","ranges":[{"to":100},{"from":100,"to":500},{"from":500}]}}}}' -H "Content-Type:application/json"Numeric range bucket stats
curl localhost:9200/<index>/_search -d '{"size":0,"aggs":{"users":{"cardinality":{"field":"user_id"}}}}' -H "Content-Type:application/json"cardinality distinct count (approx, HyperLogLog)
Query & Slowlog 5
curl localhost:9200/<index>/_count?prettyCount docs in an index
curl localhost:9200/_nodes/stats/thread_pool?prettyInspect thread-pool queue & rejected
curl localhost:9200/_nodes/stats/breaker?prettyCheck circuit breaker (large query failures)
tail -f /var/log/elasticsearch/*_index_search_slowlog.jsonFollow slow query log
curl localhost:9200/<index>/_settings?prettyShow index settings (replicas/shards)
Disk & Ops 6
curl localhost:9200/_cluster/settings?prettyShow cluster dynamic settings (disk watermarks)
curl -XPUT localhost:9200/_cluster/settings -H "Content-Type:application/json" -d '{"transient":{"cluster.routing.allocation.disk.watermark.low":"85%"}}'Temporarily adjust disk watermark (use with care)
curl -XPOST localhost:9200/_forcemerge?max_num_segments=1Force merge segments (lower disk for read-only index)
df -h /var/lib/elasticsearchCheck ES data disk usage (writes blocked past watermark)
curl -XPOST localhost:9200/<index>/_closeClose index to free resources; open to restore
curl -XPOST localhost:9200/<index>/_refreshManually refresh so recent writes are searchable
💡 Tips
- 集群变 red 先用 _cat/shards 找未分配分片，再用 allocation/explain 看原因，别急着强制分配。
- 查询变慢先区分是 filter 没走缓存还是聚合基数过高，深分页用 search_after 替代 from+size。
- 磁盘超 flood watermark 会拒绝写入，先清冷索引或调水位线，而不是直接加节点。
- text 字段用 match 做全文检索，keyword 字段用 term 精确匹配，混用会导致查不到结果。
- 批量写入用 _bulk 接口，比逐条 _doc 快一个数量级，注意 Content-Type 是 application/x-ndjson。
Official References
Commands are compiled from the official docs below. Click to verify the latest usage.
Maintained by LaoHand
Publicly updated on Jul 21, 2026, continuously proofread against official docs.
Found an error? Report it
Wrong command or description? Open an issue to help us fix it.
Found an error? Report it