ElasticSearch CheatSheet

Published on Author gryzli

ElasticSearch Example Queries 

Searching with wildcard query.


Changing the size of the search result to 100 items. 

Filter aggregations by minimum document count in the result by using min_doc_count setting.
Check cluster health information
Check cluster settings
Check index mappings and settings
Check indexes recovery stats
Check shard status


Debugging (with logs)

Debugging Master Discovery:

(Add this to elasticsearch.yml and restart elastic)



Cluster Level

Temporary Disabling Shard Re-Allocation


This is probably one of the most frequent thing you may do with your cluster during Maintenance mode.

If you are planning some of the following:

  • Restarting a node
  • Stop a node for doing upgrade
  • Stop a node …for whatever reason

You should consider temporary disabling shard reallocation. If you do not do this, you will end up with shards being reallocated between your running cluster nodes, which depending on your index size, could be really bad.


Disable Shard Re-Allocation


At this moment you may also want to sync/flush your indexes before the shutting the node from the cluster.

You can do this by:


Finally after your node has been re-started and re-join the cluster, you could re-enable shard -allocation.

Enable Shard Re-Allocation



Index Level

Creating Index Aliases

There is a very nice feature for creating index aliases. Basically you can make something like this:

index_alias --> index1-01.01.2019,index1-02.01.2019....


Create/Delete index alias

The snippet below will create index alias “shbeat-exim4-main” which will point to 3 different indexes.


Removing is also pretty simple:

To remove only one index from the alias:


You could also remove indexes by wildcard or all of them from an alias (removing all indexes, actually removes the alias itself)


Good article on Index Aliases by Elastic:



Increase the timeout for shard re-allocation when a node is missing

If a node leaves your cluster, it will automatically try (after index.unassigned.node_left.delayed_timeout time) to re-allocate the replica shards for your index.

Depending on the size of your indexes, this could lead to really cpu/io/network intensive operations for moving data between your cluster nodes.

If you know that you are going to frequently disconnect or restart nodes, it will be smart to set the unassigned.node_left.delayed_timeout setting for your Index to big enough value.


For example you could set this to “60m” (minutes), which is going to give you 60 minutes, in which your cluster wont do any shard re-allocation .

If your index is called “my_index” you could update the setting by the following command:



Keep in mind, that this option would be valid only for your current existing Indexes.

If you want this option to persist for every created or group of indexes, you should modify your Index Templates, by adding the following snippet inside:


IMPORTANT: If you loose a node temporary and you re-add it, you may want to fasten the process of allocating the unassigned shards. If you want to do that, you could temporary modify the “index.unassigned.node_left.delayed_timeout” setting to a lower value (couple of seconds), and then turn it back to the default option.


Apply setting to all existing indexes

Applying a setting to all existing indexes is easy by using the /_all/_settings api

Let say you want to update the refresh interval for all of your existing indexes to 60 seconds.