Cheatsheet

Elasticsearch Cheatsheet

Table of contents

Useful informations

Elasticsearch default transport port (between ES nodes): 9300
Elasticsearch default http port (api): 9200
Elasticsearch operator namespace: elastic-system
Elasticsearch ingress URL format: elastic.namespace.kubecluster.datacenter.kube.ingress.local
Kibana ingress URL format: kibana.namespace.kubecluster.datacenter.kube.ingress.local

Useful commands

Kubernetes Commands

List all Elasticsearch clusters from a kubernetes kibana:

kubectl get elasticsearch -A
NAMESPACE             NAME              HEALTH   NODES   VERSION   PHASE   AGE
int-es-rouge            es-rouge            green    9       8.15.0    Ready   181d
int-es-vert           es-vert           green    6       8.15.0    Ready   203d

List all kibanas from a kubernetes context:

kubectl get kibana -A

Display elasticsearch cluster nodes:

curl https://elasticsearch.endpoint:port/_cat/nodes?pretty

Display list of indices on an elasticsearch cluster:

curl https://elasticsearch.endpoint:port/_cat/indices?pretty

Display cluster health:

curl https://elasticsearch.endpoint:port/_cluster/health?pretty

Disable all shard allocation but primaries:

curl -XPUT https://elasticsearch.endpoint:port/_cluster/settings
{
  "persistent": {
    "cluster.routing.allocation.enable": "primaries"
  }
}

Enable all shard allocation:

curl -XPUT https://elasticsearch.endpoint:port/_cluster/settings
{
  "persistent": {
    "cluster.routing.allocation.enable": "all"
  }
}

Reindex an index:

curl -X POST "https:/elasticsearch.endpoint:port/_reindex" -H 'Content-Type: application/json' -d'
{
  "source": {
    "index": "my-index-000001"
  },
  "dest": {
    "index": "my-new-index-000001"
  }
}
'

Close an index:

curl -XPOST https://elasticsearch.endpoint:port/indexname/_close

Open an index:

curl -XPOST https://elasticsearch.endpoint:port/index_name/_open

Describe shard allocation problems:

curl -X GET "https://elasticsearch.endpoint:port/_cluster/allocation/explain?pretty" -H 'Content-Type: application/json' -d'
{
  "index": "my-index-000001",
  "shard": 0,
  "primary": true
}
'

Retry failed shard allocation:

curl -X POST https://https://elasticsearch.endpoint:port//_cluster/reroute?retry_failed=true?pretty

Show running tasks:

curl -XGET https://elasticsearch.endpoint:port/_tasks

Display specific task details:

curl -XGET https://elasticsearch.endpoint:port/_tasks/taskid

Set snapshot repository settings:

curl -XPUT https://elasticsearch.endpoint:port/_snapshot/s3_repository
{
  "type": "s3",
  "settings": {
    "bucket": "<bucket-name>",
    "client": "<client-name>"
  }
}

Running a snapshot for specific index:

curl -XPUT 'https:/elasticsearch.endpoint:port/_snapshot/<repo>/snapshot_name?wait_for_completion=true' \
 -d '{"indices":"XXXXX,XXXXX",
 "ignore_unavailable":true,
"include_global_state":false,
"metadata":{"taken_by":"x.xxx",
"taken_because":"because I can"}}'

Running a snapshot of all indices:

curl -XPUT 'https:/elasticsearch.endpoint:port/_snapshot/<repo>/snapshot_name'

Get snapshot status/restore progress:

curl -XGET 'https:/elasticsearch.endpoint:port/_snapshot/<repo>/snapshot_name?pretty'`

or

curl -XGET 'https:/elasticsearch.endpoint:port/_snapshot/<repo>/snapshot_name/_status?pretty'

Stop snapshot operation (Deleting the corresponding snapshot will stop all operations):

curl -XDELETE 'https://elasticsearch.endpoint:port/_snapshot/<repo>/snapshot_name?pretty'

Miscellaneous commands

Exclude data nodes for allocation:

curl -X PUT "https://elasticsearch.endpoint:port/_cluster/settings" -H 'Content-Type: application/json' -d'
{
  "persistent" : {
    "cluster.routing.allocation.exclude._name" : "data-node01,data-node02"
  }
}
'

To remove exclude configuration:

curl -X PUT "https://elasticsearch.endpoint:port/_cluster/settings" -H 'Content-Type: application/json' -d'
{
  "persistent" : {
    "cluster.routing.allocation.exclude._name" : null
  }
}
'

To view exclude configuration:

curl -X GET "https://elasticsearch.endpoint:port/_cluster/settings" -H 'Content-Type: application/json'