ElasticSearch CheatSheet

Published on Author gryzli

ElasticSearch Example Queries 

Searching with wildcard query.


Changing the size of the search result to 100 items. 

Filter aggregations by minimum document count in the result by using min_doc_count setting.
Check cluster health information
Check cluster settings
Check index mappings and settings
Check indexes recovery stats
Check shard status




Cluster Level

Temporary Disabling Shard Re-Allocation


This is probably one of the most frequent thing you may do with your cluster during Maintenance mode.

If you are planning some of the following:

  • Restarting a node
  • Stop a node for doing upgrade
  • Stop a node …for whatever reason

You should consider temporary disabling shard reallocation. If you do not do this, you will end up with shards being reallocated between your running cluster nodes, which depending on your index size, could be really bad.


Disable Shard Re-Allocation


At this moment you may also want to sync/flush your indexes before the shutting the node from the cluster.

You can do this by:


Finally after your node has been re-started and re-join the cluster, you could re-enable shard -allocation.

Enable Shard Re-Allocation



Index Level


Increase the timeout for shard re-allocation when a node is missing

If a node leaves your cluster, it will automatically try (after index.unassigned.node_left.delayed_timeout time) to re-allocate the replica shards for your index.

Depending on the size of your indexes, this could lead to really cpu/io/network intensive operations for moving data between your cluster nodes.

If you know that you are going to frequently disconnect or restart nodes, it will be smart to set the unassigned.node_left.delayed_timeout setting for your Index to big enough value.


For example you could set this to “60m” (minutes), which is going to give you 60 minutes, in which your cluster wont do any shard re-allocation .

If your index is called “my_index” you could update the setting by the following command:



Keep in mind, that this option would be valid only for your current existing Indexes.

If you want this option to persist for every created or group of indexes, you should modify your Index Templates, by adding the following snippet inside:


IMPORTANT: If you loose a node temporary and you re-add it, you may want to fasten the process of allocating the unassigned shards. If you want to do that, you could temporary modify the “index.unassigned.node_left.delayed_timeout” setting to a lower value (couple of seconds), and then turn it back to the default option.


Apply setting to all existing indexes

Applying a setting to all existing indexes is easy by using the /_all/_settings api

Let say you want to update the refresh interval for all of your existing indexes to 60 seconds.