• Elasticsearch Guide: 8.196.4other versionsother versions: 8.198.188.178.168.158.148.138.128.118.108.98.88.78.68.58.48.38.28.18.07.177.167.157.147.137.127.117.107.97.87.77.67.57.47.37.27.17.06.86.76.66.56.46.36.26.16.05.65.55.45.35.25.15.02.42.32.22.12.01.71.61.51.41.30.90
• Getting Started
  • Basic Concepts
  • Installation
  • Exploring Your Cluster
    • Cluster Health
    • List All Indices
    • Create an Index
    • Index and Query a Document
    • Delete an Index
  • Modifying Your Data
    • Updating Documents
    • Deleting Documents
    • Batch Processing
  • Exploring Your Data
    • The Search API
    • Introducing the Query Language
    • Executing Searches
    • Executing Filters
    • Executing Aggregations
  • Conclusion
• Set up Elasticsearch
  • Installing Elasticsearch
    • Install Elasticsearch with .zip or .tar.gz
    • Install Elasticsearch with .zip on Windows
    • Install Elasticsearch with Debian Package
    • Install Elasticsearch with RPM
    • Install Elasticsearch with Windows MSI Installer
    • Install Elasticsearch with Docker
  • Configuring Elasticsearch
    • Setting JVM options
    • Secure settings
    • Logging configuration
  • Important Elasticsearch configuration
    • path.data and path.logs
    • cluster.name
    • node.name
    • network.host
    • Discovery settings
    • Setting the heap size
    • JVM heap dump path
    • GC logging
    • Temp directory
    • JVM fatal error logs
  • Important System Configuration
    • Configuring system settings
    • Disable swapping
    • File Descriptors
    • Virtual memory
    • Number of threads
    • DNS cache settings
  • Bootstrap Checks
    • Heap size check
    • File descriptor check
    • Memory lock check
    • Maximum number of threads check
    • Max file size check
    • Maximum size virtual memory check
    • Maximum map count check
    • Client JVM check
    • Use serial collector check
    • System call filter check
    • OnError and OnOutOfMemoryError checks
    • Early-access check
    • G1GC check
    • All permission check
  • Starting Elasticsearch
  • Stopping Elasticsearch
  • Adding nodes to your cluster
  • Installing X-Pack
  • Set up X-Pack
  • Configuring X-Pack Java Clients
  • X-Pack Settings
    • License Settings
    • Machine Learning Settings
    • Monitoring Settings
    • Watcher Settings
    • SQL Access Settings
  • Bootstrap Checks for X-Pack
• Upgrade Elasticsearch
  • Rolling upgrades
  • Full cluster restart upgrade
  • Reindex before upgrading
    • Reindex in place
    • Reindex from a remote cluster
• API Conventions
  • Multiple Indices
  • Date math support in index names
  • Common options
  • URL-based access control
• Document APIs
  • Reading and Writing documents
  • Index API
  • Get API
  • Delete API
  • Delete By Query API
  • Update API
  • Update By Query API
  • Multi Get API
  • Bulk API
  • Reindex API
  • Term Vectors
  • Multi termvectors API
  • ?refresh
• Search APIs
  • Search
  • URI Search
  • Request Body Search
    • Query
    • From / Size
    • Sort
    • Source filtering
    • Fields
    • Script Fields
    • Doc value Fields
    • Post filter
    • Highlighting
    • Rescoring
    • Search Type
    • Scroll
    • Preference
    • Explain
    • Version
    • Index Boost
    • min_score
    • Named Queries
    • Inner hits
    • Field Collapsing
    • Search After
  • Search Template
  • Multi Search Template
  • Search Shards API
  • Suggesters
    • Term suggester
    • Phrase Suggester
    • Completion Suggester
    • Context Suggester
    • Returning the type of the suggester
  • Multi Search API
  • Count API
  • Validate API
  • Explain API
  • Profile API
    • Profiling Queries
    • Profiling Aggregations
    • Profiling Considerations
  • Field Capabilities API
  • Ranking Evaluation API
• Aggregations
  • Metrics Aggregations
    • Avg Aggregation
    • Weighted Avg Aggregation
    • Cardinality Aggregation
    • Extended Stats Aggregation
    • Geo Bounds Aggregation
    • Geo Centroid Aggregation
    • Max Aggregation
    • Min Aggregation
    • Percentiles Aggregation
    • Percentile Ranks Aggregation
    • Scripted Metric Aggregation
    • Stats Aggregation
    • Sum Aggregation
    • Top Hits Aggregation
    • Value Count Aggregation
  • Bucket Aggregations
    • Adjacency Matrix Aggregation
    • Children Aggregation
    • Composite Aggregation
    • Date Histogram Aggregation
    • Date Range Aggregation
    • Diversified Sampler Aggregation
    • Filter Aggregation
    • Filters Aggregation
    • Geo Distance Aggregation
    • GeoHash grid Aggregation
    • Global Aggregation
    • Histogram Aggregation
    • IP Range Aggregation
    • Missing Aggregation
    • Nested Aggregation
    • Range Aggregation
    • Reverse nested Aggregation
    • Sampler Aggregation
    • Significant Terms Aggregation
    • Significant Text Aggregation
    • Terms Aggregation
  • Pipeline Aggregations
    • Avg Bucket Aggregation
    • Derivative Aggregation
    • Max Bucket Aggregation
    • Min Bucket Aggregation
    • Sum Bucket Aggregation
    • Stats Bucket Aggregation
    • Extended Stats Bucket Aggregation
    • Percentiles Bucket Aggregation
    • Moving Average Aggregation
    • Moving Function Aggregation
    • Cumulative Sum Aggregation
    • Bucket Script Aggregation
    • Bucket Selector Aggregation
    • Bucket Sort Aggregation
    • Serial Differencing Aggregation
  • Matrix Aggregations
    • Matrix Stats
  • Caching heavy aggregations
  • Returning only aggregation results
  • Aggregation Metadata
  • Returning the type of the aggregation
• Indices APIs
  • Create Index
  • Delete Index
  • Get Index
  • Indices Exists
  • Open / Close Index API
  • Shrink Index
  • Split Index
  • Rollover Index
  • Put Mapping
  • Get Mapping
  • Get Field Mapping
  • Types Exists
  • Index Aliases
  • Update Indices Settings
  • Get Settings
  • Analyze
    • Explain Analyze
  • Index Templates
  • Indices Stats
  • Indices Segments
  • Indices Recovery
  • Indices Shard Stores
  • Clear Cache
  • Flush
    • Synced Flush
  • Refresh
  • Force Merge
• cat APIs
  • cat aliases
  • cat allocation
  • cat count
  • cat fielddata
  • cat health
  • cat indices
  • cat master
  • cat nodeattrs
  • cat nodes
  • cat pending tasks
  • cat plugins
  • cat recovery
  • cat repositories
  • cat thread pool
  • cat shards
  • cat segments
  • cat snapshots
  • cat templates
• Cluster APIs
  • Cluster Health
  • Cluster State
  • Cluster Stats
  • Pending cluster tasks
  • Cluster Reroute
  • Cluster Update Settings
  • Cluster Get Settings
  • Nodes Stats
  • Nodes Info
  • Nodes Feature Usage
  • Remote Cluster Info
  • Task Management API
  • Nodes hot_threads
  • Cluster Allocation Explain API
• Query DSL
  • Query and filter context
  • Match All Query
  • Full text queries
    • Match Query
    • Match Phrase Query
    • Match Phrase Prefix Query
    • Multi Match Query
    • Common Terms Query
    • Query String Query
    • Simple Query String Query
  • Term level queries
    • Term Query
    • Terms Query
    • Terms Set Query
    • Range Query
    • Exists Query
    • Prefix Query
    • Wildcard Query
    • Regexp Query
    • Fuzzy Query
    • Type Query
    • Ids Query
  • Compound queries
    • Constant Score Query
    • Bool Query
    • Dis Max Query
    • Function Score Query
    • Boosting Query
  • Joining queries
    • Nested Query
    • Has Child Query
    • Has Parent Query
    • Parent Id Query
  • Geo queries
    • GeoShape Query
    • Geo Bounding Box Query
    • Geo Distance Query
    • Geo Polygon Query
  • Specialized queries
    • More Like This Query
    • Script Query
    • Percolate Query
    • Wrapper Query
  • Span queries
    • Span Term Query
    • Span Multi Term Query
    • Span First Query
    • Span Near Query
    • Span Or Query
    • Span Not Query
    • Span Containing Query
    • Span Within Query
    • Span Field Masking Query
  • Minimum Should Match
  • Multi Term Query Rewrite
• Mapping
  • Removal of mapping types
  • Field datatypes
    • Alias datatype
    • Arrays
    • Binary datatype
    • Range datatypes
    • Boolean datatype
    • Date datatype
    • Geo-point datatype
    • Geo-Shape datatype
    • IP datatype
    • Keyword datatype
    • Nested datatype
    • Numeric datatypes
    • Object datatype
    • Text datatype
    • Token count datatype
    • Percolator type
    • join datatype
  • Meta-Fields
    • _all field
    • _field_names field
    • _ignored field
    • _id field
    • _index field
    • _meta field
    • _routing field
    • _source field
    • _type field
    • _uid field
  • Mapping parameters
    • analyzer
    • normalizer
    • boost
    • coerce
    • copy_to
    • doc_values
    • dynamic
    • enabled
    • eager_global_ordinals
    • fielddata
    • format
    • ignore_above
    • ignore_malformed
    • index
    • index_options
    • fields
    • norms
    • null_value
    • position_increment_gap
    • properties
    • search_analyzer
    • similarity
    • store
    • term_vector
  • Dynamic Mapping
    • Dynamic field mapping
    • Dynamic templates
    • _default_ mapping
• Analysis
  • Anatomy of an analyzer
  • Testing analyzers
  • Analyzers
    • Configuring built-in analyzers
    • Standard Analyzer
    • Simple Analyzer
    • Whitespace Analyzer
    • Stop Analyzer
    • Keyword Analyzer
    • Pattern Analyzer
    • Language Analyzers
    • Fingerprint Analyzer
    • Custom Analyzer
  • Normalizers
  • Tokenizers
    • Standard Tokenizer
    • Letter Tokenizer
    • Lowercase Tokenizer
    • Whitespace Tokenizer
    • UAX URL Email Tokenizer
    • Classic Tokenizer
    • Thai Tokenizer
    • NGram Tokenizer
    • Edge NGram Tokenizer
    • Keyword Tokenizer
    • Pattern Tokenizer
    • Char Group Tokenizer
    • Simple Pattern Tokenizer
    • Simple Pattern Split Tokenizer
    • Path Hierarchy Tokenizer
    • Path Hierarchy Tokenizer Examples
  • Token Filters
    • Standard Token Filter
    • ASCII Folding Token Filter
    • Flatten Graph Token Filter
    • Length Token Filter
    • Lowercase Token Filter
    • Uppercase Token Filter
    • NGram Token Filter
    • Edge NGram Token Filter
    • Porter Stem Token Filter
    • Shingle Token Filter
    • Stop Token Filter
    • Word Delimiter Token Filter
    • Word Delimiter Graph Token Filter
    • Multiplexer Token Filter
    • Stemmer Token Filter
    • Stemmer Override Token Filter
    • Keyword Marker Token Filter
    • Keyword Repeat Token Filter
    • KStem Token Filter
    • Snowball Token Filter
    • Phonetic Token Filter
    • Synonym Token Filter
    • Synonym Graph Token Filter
    • Compound Word Token Filters
    • Reverse Token Filter
    • Elision Token Filter
    • Truncate Token Filter
    • Unique Token Filter
    • Pattern Capture Token Filter
    • Pattern Replace Token Filter
    • Trim Token Filter
    • Limit Token Count Token Filter
    • Hunspell Token Filter
    • Common Grams Token Filter
    • Normalization Token Filter
    • CJK Width Token Filter
    • CJK Bigram Token Filter
    • Delimited Payload Token Filter
    • Keep Words Token Filter
    • Keep Types Token Filter
    • Exclude mode settings example
    • Classic Token Filter
    • Apostrophe Token Filter
    • Decimal Digit Token Filter
    • Fingerprint Token Filter
    • Minhash Token Filter
    • Remove Duplicates Token Filter
  • Character Filters
    • HTML Strip Char Filter
    • Mapping Char Filter
    • Pattern Replace Char Filter
• Modules
  • Cluster
    • Cluster Level Shard Allocation
    • Disk-based Shard Allocation
    • Shard Allocation Awareness
    • Shard Allocation Filtering
    • Miscellaneous cluster settings
  • Discovery
    • Azure Classic Discovery
    • EC2 Discovery
    • Google Compute Engine Discovery
    • Zen Discovery
  • Local Gateway
  • HTTP
  • Indices
    • Circuit Breaker
    • Fielddata
    • Node Query Cache
    • Indexing Buffer
    • Shard request cache
    • Indices Recovery
  • Network Settings
  • Node
  • Plugins
  • Scripting
    • How to use scripts
    • Accessing document fields and special variables
    • Scripting and security
    • Painless Scripting Language
    • Lucene Expressions Language
    • Advanced scripts using script engines
  • Snapshot And Restore
  • Thread Pool
  • Transport
  • Tribe node
  • Cross-cluster search
• Index Modules
  • Analysis
  • Index Shard Allocation
    • Shard Allocation Filtering
    • Delaying allocation when a node leaves
    • Index recovery prioritization
    • Total Shards Per Node
  • Mapper
  • Merge
  • Similarity module
  • Slow Log
  • Store
    • Pre-loading data into the file system cache
  • Translog
  • Index Sorting
    • Use index sorting to speed up conjunctions
• Ingest Node
  • Pipeline Definition
  • Ingest APIs
    • Put Pipeline API
    • Get Pipeline API
    • Delete Pipeline API
    • Simulate Pipeline API
  • Accessing Data in Pipelines
  • Handling Failures in Pipelines
  • Processors
    • Append Processor
    • Bytes Processor
    • Convert Processor
    • Date Processor
    • Date Index Name Processor
    • Fail Processor
    • Foreach Processor
    • Grok Processor
    • Gsub Processor
    • Join Processor
    • JSON Processor
    • KV Processor
    • Lowercase Processor
    • Remove Processor
    • Rename Processor
    • Script Processor
    • Set Processor
    • Split Processor
    • Sort Processor
    • Trim Processor
    • Uppercase Processor
    • Dot Expander Processor
    • URL Decode Processor
• SQL Access
  • Overview
  • Getting Started with SQL
  • Conventions and Terminology
    • Mapping concepts across SQL and Elasticsearch
  • Security
  • SQL REST API
  • SQL Translate API
  • SQL CLI
  • SQL JDBC
    • API usage
  • SQL Language
  • Data Types
  • SQL Commands
    • DESCRIBE TABLE
    • SELECT
    • SHOW COLUMNS
    • SHOW FUNCTIONS
    • SHOW TABLES
  • Functions and Operators
    • Comparison Operators
    • Logical Operators
    • Math Operators
    • Math Functions
    • Date and Time Functions
    • Aggregate Functions
  • Reserved keywords
• Monitor a cluster
  • Overview
  • How it works
  • Monitoring in a production environment
  • Configuring monitoring
    • Pausing data collection
    • Configuring indices for monitoring
    • Configuring a tribe node to work with monitoring
  • Collectors
  • Exporters
    • Local Exporters
    • HTTP exporters
  • Troubleshooting
• Rolling up historical data
  • Overview
    • Rollup store historical data at reduced granularity
    • Rollup uses standard query DSL
    • Rollup merges "live" and "rolled" data
    • Rollup is multi-interval aware
  • API Quick Reference
  • Getting Started
  • Understanding Groups
    • Grouping Limitations with heterogeneous indices
    • Doc counts and overlapping jobs
  • Rollup Aggregation Limitations
  • Rollup Search Limitations
• Secure a cluster
  • Overview
  • Configuring Security
    • Encrypting communications in Elasticsearch
    • Encrypting Communications in an Elasticsearch Docker Container
    • Enabling cipher suites for stronger encryption
    • Separating node-to-node and client traffic
    • Configuring an Active Directory realm
    • Configuring a file realm
    • Configuring an LDAP realm
    • Configuring a native realm
    • Configuring a PKI realm
    • Configuring a SAML realm
    • Configuring a Kerberos realm
    • FIPS 140-2
    • Security settings
    • Auditing settings
  • Getting started with security
    • Install a trial license
    • Enable security in Elasticsearch
    • Create passwords for built-in users
    • Add the built-in user to Kibana
    • Configure authentication
    • Create users
    • Assign roles
    • Add user information in Logstash
    • View system metrics in Kibana
  • How security works
  • User authentication
    • Built-in users
    • Internal users
    • Realms
    • Active Directory user authentication
    • File-based user authentication
    • LDAP user authentication
    • Native user authentication
    • PKI user authentication
    • SAML authentication
    • Kerberos authentication
    • Integrating with other authentication systems
    • Enabling anonymous access
    • Controlling the user cache
  • Configuring SAML single-sign-on on the Elastic Stack
    • The identity provider
    • Configure Elasticsearch for SAML authentication
    • Generating SP metadata
    • Configuring role mappings
    • User metadata
    • Configuring Kibana
    • Troubleshooting SAML Realm Configuration
  • User authorization
    • Built-in roles
    • Defining roles
    • Security privileges
    • Document level security
    • Field level security
    • Granting privileges for indices and aliases
    • Mapping users and groups to roles
    • Setting up field and document level security
    • Submitting requests on behalf of other users
    • Custom roles provider extension
  • Auditing security events
    • Audit event types
    • Logfile audit output
    • Index audit output
    • Forwarding audit logs to a remote cluster
  • Encrypting communications
    • Setting Up TLS on a Cluster
  • Restricting connections with IP filtering
  • Cross cluster search, tribe, clients, and integrations
    • Cross cluster search and security
    • Tribe nodes and security
    • Java client and security
    • HTTP/REST clients and security
    • ES-Hadoop and security
    • Beats and security
    • Monitoring and Security
  • Reference
    • Security Files
  • Troubleshooting
    • Can’t log in after upgrading to 6.4.3
    • Some settings are not returned via the nodes settings API
    • Authorization exceptions
    • Users command fails due to extra arguments
    • Users are frequently locked out of Active Directory
    • Certificate verification fails for curl on Mac
    • SSLHandshakeException causes connections to fail
    • Common SSL/TLS exceptions
    • Common Kerberos exceptions
    • Common SAML issues
    • Internal Server Error in Kibana
    • Setup-passwords command fails due to connection failure
    • Failures due to relocation of the configuration files
  • Limitations
• Alerting on Cluster and Index Events
  • Getting Started with Watcher
  • How Watcher works
  • Encrypting sensitive data in Watcher
  • Inputs
    • Simple input
    • Search input
    • HTTP input
    • Chain input
  • Triggers
    • Schedule trigger
  • Conditions
    • Always condition
    • Never condition
    • Compare condition
    • Array compare condition
    • Script condition
  • Actions
    • Adding conditions to actions
    • Email action
    • Webhook action
    • Index action
    • Logging action
    • HipChat action
    • Slack action
    • PagerDuty action
    • Jira action
  • Transforms
    • Search transform
    • Script transform
    • Chain transform
  • Java API
  • Managing watches
  • Example watches
    • Watching the status of an Elasticsearch cluster
    • Watching event data
  • Troubleshooting
  • Limitations
• X-Pack APIs
  • Info API
  • Explore API
  • Licensing APIs
    • Delete License API
    • Get License API
    • Get Trial Status API
    • Start Trial API
    • Get Basic Status API
    • Start Basic API
    • Update License API
  • Migration APIs
    • Migration Assistance API
    • Migration Upgrade API
    • Deprecation Info APIs
  • Machine Learning APIs
    • Add Events to Calendar
    • Add Jobs to Calendar
    • Close Jobs
    • Create Calendar
    • Create Datafeeds
    • Create Filter
    • Create Jobs
    • Delete Calendar
    • Delete Datafeeds
    • Delete Events from Calendar
    • Delete Filter
    • Delete Jobs
    • Delete Jobs from Calendar
    • Delete Model Snapshots
    • Flush Jobs
    • Forecast Jobs
    • Get Calendars
    • Get Buckets
    • Get Overall Buckets
    • Get Categories
    • Get Datafeeds
    • Get Datafeed Statistics
    • Get Influencers
    • Get Jobs
    • Get Job Statistics
    • Get Model Snapshots
    • Get Scheduled Events
    • Get Filters
    • Get Records
    • Open Jobs
    • Post Data to Jobs
    • Preview Datafeeds
    • Revert Model Snapshots
    • Start Datafeeds
    • Stop Datafeeds
    • Update Datafeeds
    • Update Filter
    • Update Jobs
    • Update Model Snapshots
  • Rollup APIs
    • Delete Job
    • Get Job
    • Create Job
    • Start Job
    • Stop Job
    • Get Rollup Caps
    • Rollup Search
    • Rollup Job Configuration
  • Security APIs
    • Create or update application privileges API
    • Authenticate API
    • Change passwords API
    • Clear Cache API
    • Create or update role mappings API
    • Clear roles cache API
    • Create or update roles API
    • Create or update users API
    • Delete application privileges API
    • Delete role mappings API
    • Delete roles API
    • Delete users API
    • Disable users API
    • Enable users API
    • Get application privileges API
    • Get role mappings API
    • Get roles API
    • Get token API
    • Get users API
    • Has Privileges API
    • Invalidate token API
    • SSL Certificate API
  • Watcher APIs
    • Put Watch API
    • Get watch API
    • Delete watch API
    • Execute watch API
    • Ack watch API
    • Activate watch API
    • Deactivate watch API
    • Stats API
    • Stop API
    • Start API
    • Restart API
  • Definitions
    • Calendar Resources
    • Datafeed Resources
    • Filter Resources
    • Job Resources
    • Job Statistics
    • Model Snapshot Resources
    • Role mapping resources
    • Results Resources
    • Scheduled Event Resources
• Command line tools
  • elasticsearch-certgen
  • elasticsearch-certutil
  • elasticsearch-migrate
  • elasticsearch-saml-metadata
  • elasticsearch-setup-passwords
  • elasticsearch-syskeygen
  • elasticsearch-users
• How To
  • General recommendations
  • Recipes
    • Mixing exact search with stemming
    • Getting consistent scoring
  • Tune for indexing speed
  • Tune for search speed
    • Tune your queries with the Profile API
  • Tune for disk usage
• Testing
  • Java Testing Framework
    • why randomized testing?
    • Using the Elasticsearch test classes
    • unit tests
    • Integration tests
    • Randomized testing
    • Assertions
• Glossary of terms
• Release Highlights
  • 6.4.0
  • 6.3.0
• Breaking changes
  • 6.0
  • 6.1
  • 6.2
  • 6.3
  • 6.4
• Release Notes
  • Elasticsearch version 6.4.3
  • Elasticsearch version 6.4.2
  • Elasticsearch version 6.4.1
  • Elasticsearch version 6.4.0
  • Elasticsearch version 6.3.2
  • Elasticsearch version 6.3.1
  • Elasticsearch version 6.3.0
  • Elasticsearch version 6.2.4
  • Elasticsearch version 6.2.3
  • Elasticsearch version 6.2.2
  • Elasticsearch version 6.2.1
  • Elasticsearch version 6.2.0
  • Elasticsearch version 6.1.4
  • Elasticsearch version 6.1.3
  • Elasticsearch version 6.1.2
  • Elasticsearch version 6.1.1
  • Elasticsearch version 6.1.0
  • Elasticsearch version 6.0.1
  • Elasticsearch version 6.0.0
  • Elasticsearch version 6.0.0-rc2
  • Elasticsearch version 6.0.0-rc1
  • Elasticsearch version 6.0.0-beta2
  • Elasticsearch version 6.0.0-beta1
  • Elasticsearch version 6.0.0-alpha2
  • Elasticsearch version 6.0.0-alpha1
  • Elasticsearch version 6.0.0-alpha1 (Changes previously released in 5.x)