Search query

Full-text search for documents matching a term

curl -s -X POST http://localhost:9200/<index>/_search -H 'Content-Type: application/json' -d '{"query":{"match":{"message":"error"}}}'

More elasticsearch commands

Snapshot create

curl -X PUT http://localhost:9200/_snapshot/<repo>/<snapshot>

Create a snapshot to the registered repository
ILM explain index

curl -s 'http://localhost:9200/<index>/_ilm/explain' | jq '.indices | to_entries[] | {index:.key, phase:.value.phase, action:.value.action}'

Show current ILM lifecycle phase and action for an index
Check cluster health

curl -s http://es:9200/_cluster/health?pretty

Show cluster status: green/yellow/red with shard counts
List indices with size

curl -s 'http://es:9200/_cat/indices?v&s=store.size:desc'

All indices sorted by store size (largest first)
Delete old index

curl -X DELETE http://es:9200/logs-2024.01.01

Remove a specific index (irreversible)