====== Elasticsearch Cheatsheet ======

=== Get the Elasticsearch version and tagline ===

<code bash>
GET /

</code>

=== Browse the documentation related to your elasticsearch version ===

Go to [[https://www.elastic.co/guide/en/elasticsearch/reference/X.Y/index.html|https://www.elastic.co/guide/en/elasticsearch/reference/X.Y/index.html]]

=== Quickly explore existing indices ===
<code bash>

GET _cat/indices/<index_pattern>?v

</code>

=== Quickly explore existing aliases ===

<code bash>
GET /_cat/aliases/<alias_pattern>?v

</code>

=== Quickly get settings, mappings and aliases of an index ===

<code bash>
GET <index>/

</code>

=== Switch / Manage aliases ===

<code bash>
POST /_aliases
{
  "actions": [
    {
   "remove": {
        "index": "<old_index>",
        "alias": "<index_alias>"
      }
    },
    {
      "add": {
        "index": "<new_index>",
        "alias": "<index_alias>"
      }
    }
  ]
}

</code>

=== Quickly explore the data in an index ===

<code bash>
GET /<index>/_search
{
  "from": 0,
  "size": 20,
  "_source": {
    "include": [
   "<field_patterns_to_include>"
    ],
    "exclude": [
      "<field_patterns_to_exclude>"
    ]
  },
  "query": {
    "match_all": {}
  },
  "aggs": {
    "<field_agg_name>": {
      "terms": {
        "field": "<field>.keyword",
        "size": 10
      }
    }
  }
}

</code>

=== Quickly get some data based on exact values and sorted ===

<code bash>
GET /<index_or_alias>/_search
{
  "from": 0,
  "size": 20,
  "query": {
    "bool": {
   "filter": {
        "terms": {
          "<field>.keyword": [
            "value_1",
            "value_2"
          ]
        }
      }
    }
  },
  "sort": [
    {
      "<sort_field>": {
        "order": "desc"
      }
    }
  ]
}

</code>

=== Quickly get data matching several fields and explain the relevancy ===

<code bash>
GET /<index_or_alias>/_search
{
  "explain": true,
  "query": {
    "multi_match": {
   "query": "<query>",
      "fields": [
        "<field1>^10",
        "<field2>"
      ]
    }
  }
}

</code>

=== Quickly check how a text is analyzed ===

<code bash>
GET <index>/_analyze
{
  "field" : "<field>",
  "text" : "<text to analyze>"
}

</code>

<code bash>
GET <index>/_analyze
{
  "analyzer" : "standard",
  "text" : "<text to analyze>"
}

</code>

=== Explore data grouped by a field ===

<code bash>
GET /<index_or_alias>/_search
{
  "size": 10,
  "_source": {
    "excludes": "*"
  },
  "query": {
    "match": {
   "<field>": {
        "query": "<query>"
      }
    }
  },
  "collapse": {
    "field": "<collapse_field>.keyword",
    "inner_hits": {
      "size": 5,
      "name": "inner_hits",
      "highlight": {
        "fields": {
          "<field>": {}
        }
      },
      "sort": [
        {
          "<inner_hits_sort_field>": {
            "order": "asc"
          }
        }
      ]
    }
  }
}

</code>

=== Quicky explore top terms ===

<code bash>
GET /<index_or_alias>/_search
{
  "size": 0,
  "aggs": {
    "<agg1>": {
   "terms": {
        "field": "<field1>.keyword",
        "size": 10
      }
    }
  }
}

</code>

=== Explore significant terms within one group ===

<code bash>
GET /<index_or_alias>/_search
{
  "size": 0,
  "aggs": {
    "<agg1>": {
   "terms": {
        "field": "<field1>.keyword",
        "size": 10
      },
      "aggs": {
        "<agg1.1>": {
          "significant_terms": {
            "field": "<field2>.keyword"
          }
        }
      }
    }
  }
}

</code>

=== Explore top terms and get details on top hits ===

<code bash>
GET /<index_or_alias>/_search
{
  "size": 0,
  "aggs": {
    "<agg1>": {
   "terms": {
        "field": "<field>.keyword",
        "size": 10
      },
      "aggs": {
        "<details>": {
          "top_hits": {
            "size": 1,
            "_source": [
              "<details_field>.*"
            ],
            "highlight": {
              "pre_tags": [
                "<em>"
              ],
              "post_tags": [
                "</em>"
              ],
              "fields": {
                "<highlight_fields>.*": {
                  "number_of_fragments": 0
                }
              }
            }
          }
        }
      }
    }
  }
}

</code>

=== Quickly find min and max values of one field ===

<code bash>
GET /<index_or_alias>/_search
{
  "size": 0,
  "aggs": {
    "min" : {
   "min": {
        "field": "<field>"
      }
    },
    "max" : {
      "max": {
        "field": "<field>"
      }
    }
  }
}

</code>

=== Quickly display a date histogram ===

<code bash>
GET /<index_or_alias>/_search
{
  "size": 0,
  "aggs": {
    "histogram": {
   "date_histogram": {
        "field": "<date_field>",
        "interval": "day"
      }
    }
  }
}

</code>

=== Quickly update the value of a field in a document ===

<code bash>
POST <index>/<type>/<id>/_update
{
  "doc": {
    "<field>": {
   "<optional_inner_field>": "<new value>"
    }
  }
}

</code>

=== Quickly increment the value of a field in a document ===

<code bash>
POST <index>/<type>/<id>/_update
{
    "script" : {
   "source": "ctx._source.<field>.<optional_inner_field> += params.count",
        "lang": "painless",
        "params" : {
            "count" : 1
        }
    }
}

</code>

=== Get active index templates ===

<code bash>
GET _template/<template_name_pattern>

</code>

=== Update or create an index template ===

<code bash>
PUT /_template/<template_name>
{
  "index_patterns": "<index_pattern>",
  "settings": {
    "index.refresh_interval": "5s",
    "index.number_of_replicas": "0",
    "index.number_of_shards": "1",
    "analysis": {}
  },
  "mappings": {
    "<type>": {
   "properties": {
        "<date_field>": {
          "type": "date"
        }
      }
    }
  },
  "aliases": {
    "<index_alias>": {}
  }
}

</code>

=== Quickly reindex (after template or mapping changes) ===

<code bash>
POST _reindex
{
  "source": {
    "index": "<index1>"
  },
  "dest": {
    "index": "<index1a>"
  }
}

</code>

=== Get nodes information ===

<code bash>
GET _cat/nodes?v

</code>

=== Get the cluster health ===

<code bash>
GET _cluster/health

</code>

=== Get all the cluster metadata ===

<code bash>
GET _cluster/state

</code>

=== Get all nodes statistics ===

<code bash>
GET _nodes/stats

</code>

=== Activate the search slow log on an index ===

<code bash>
PUT <index>/_settings
{
  "index": {
    "search.slowlog.threshold.query.trace": "0s",
    "search.slowlog.threshold.fetch.trace": "0s",
    "search.slowlog.threshold.query.debug": "0s",
    "search.slowlog.threshold.fetch.debug": "0s",
    "search.slowlog.threshold.query.info": "0s",
    "search.slowlog.threshold.fetch.info": "0s",
    "search.slowlog.threshold.query.warn": "0s",
    "search.slowlog.threshold.fetch.warn": "0s"
  }
}

</code>

<code bash>
$ tail -f <path.logs>/<index>_index_search_slowlog.log

</code>

=== Quickly snapshot ===

<code bash>
GET /_snapshot/_all
PUT /_snapshot/<backup>
{
  "type": "fs",
  "settings": {
    "compress": true,
    "location": "<path.repo>/<backup>"
  }
}
PUT /_snapshot/<backup>/<snapshot>?wait_for_completion=false
{
  "indices": "index1,index2",
  "ignore_unavailable": false,
  "include_global_state": false
}
GET /_snapshot/<backup>/<snapshot>
GET /_snapshot/<backup>/<snapshot>/_status

</code>

=== Quickly restore ===

<code bash>
POST /_snapshot/<backup>/<snapshot>/_restore
{
  "indices": "index1",
  "index_settings": {
    "index.number_of_replicas": 0
  }
}

</code>

=== Run the support diagnostics ===

Go to [[https://github.com/elastic/elasticsearch-support-diagnostics/releases/latest|https://github.com/elastic/elasticsearch-support-diagnostics/releases/latest]]
<code bash>

$ wget https://github.com/elastic/support-diagnostics/releases/download/X.Y/support-diagnostics-X.Y-dist.zip
$ unzip support-diagnostics-X.Y-dist.zip
$ cd support-diagnostics-X.Y/
$ ./diagnostics.sh --host localhost --port 9200 --type remote

</code>

See the output in ''remote-diagnostics-<date>.tar.gz''