API Reference

Bulk index or delete documents. Performs multiple indexing or delete operations in a single API call. This reduces overhead and can greatly increase indexing speed.

Endpoint documentation

client.bulk({ ... })

Clear a scrolling search.

Clear the search context and results for a scrolling search.

Endpoint documentation

client.clearScroll({ ... })

Close a point in time.

A point in time must be opened explicitly before being used in search requests. The keep_alive parameter tells Elasticsearch how long it should persist. A point in time is automatically closed when the keep_alive period has elapsed. However, keeping points in time has a cost; close them as soon as they are no longer required for search requests.

Endpoint documentation

client.closePointInTime({ id })

Count search results. Get the number of documents matching a query.

Endpoint documentation

client.count({ ... })

Index a document. Adds a JSON document to the specified data stream or index and makes it searchable. If the target is an index and the document already exists, the request updates the document and increments its version.

Endpoint documentation

client.create({ id, index })

Delete a document. Removes a JSON document from the specified index.

Endpoint documentation

client.delete({ id, index })

Delete documents. Deletes documents that match the specified query.

Endpoint documentation

client.deleteByQuery({ index })

Throttle a delete by query operation.

Change the number of requests per second for a particular delete by query operation. Rethrottling that speeds up the query takes effect immediately but rethrotting that slows down the query takes effect after completing the current batch to prevent scroll timeouts.

Endpoint documentation

client.deleteByQueryRethrottle({ task_id })

Delete a script or search template. Deletes a stored script or search template.

Endpoint documentation

client.deleteScript({ id })

Check a document. Checks if a specified document exists.

Endpoint documentation

client.exists({ id, index })

Check for a document source. Checks if a document’s _source is stored.

Endpoint documentation

client.existsSource({ id, index })

Explain a document match result. Returns information about why a specific document matches, or doesn’t match, a query.

Endpoint documentation

client.explain({ id, index })

Get the field capabilities.

Get information about the capabilities of fields among multiple indices.

For data streams, the API returns field capabilities among the stream’s backing indices. It returns runtime fields like any other field. For example, a runtime field with a type of keyword is returned the same as any other field that belongs to the keyword family.

Endpoint documentation

client.fieldCaps({ ... })

Get a document by its ID. Retrieves the document with the specified ID from an index.

Endpoint documentation

client.get({ id, index })

Get a script or search template. Retrieves a stored script or search template.

Endpoint documentation

client.getScript({ id })

Get script contexts.

Get a list of supported script contexts and their methods.

Endpoint documentation

client.getScriptContext()

Get script languages.

Get a list of available script types, languages, and contexts.

Endpoint documentation

client.getScriptLanguages()

Get a document’s source. Returns the source of a document.

Endpoint documentation

client.getSource({ id, index })

Get the cluster health. Get a report with the health status of an Elasticsearch cluster. The report contains a list of indicators that compose Elasticsearch functionality.

Each indicator has a health status of: green, unknown, yellow or red. The indicator will provide an explanation and metadata describing the reason for its current health status.

The cluster’s status is controlled by the worst indicator status.

In the event that an indicator’s status is non-green, a list of impacts may be present in the indicator result which detail the functionalities that are negatively affected by the health issue. Each impact carries with it a severity level, an area of the system that is affected, and a simple description of the impact on the system.

Some health indicators can determine the root cause of a health problem and prescribe a set of steps that can be performed in order to improve the health of the system. The root cause and remediation steps are encapsulated in a diagnosis. A diagnosis contains a cause detailing a root cause analysis, an action containing a brief description of the steps to take to fix the problem, the list of affected resources (if applicable), and a detailed step-by-step troubleshooting guide to fix the diagnosed problem.

Endpoint documentation

client.healthReport({ ... })

Index a document. Adds a JSON document to the specified data stream or index and makes it searchable. If the target is an index and the document already exists, the request updates the document and increments its version.

Endpoint documentation

client.index({ index })

Get cluster info. Returns basic information about the cluster.

Endpoint documentation

client.info()

Run a knn search.

Perform a k-nearest neighbor (kNN) search on a dense_vector field and return the matching documents. Given a query vector, the API finds the k closest vectors and returns those documents as search hits.

Elasticsearch uses the HNSW algorithm to support efficient kNN search. Like most kNN algorithms, HNSW is an approximate method that sacrifices result accuracy for improved search speed. This means the results returned are not always the true k closest neighbors.

The kNN search API supports restricting the search using a filter. The search will return the top k documents that also match the filter query.

Endpoint documentation

client.knnSearch({ index, knn })

Get multiple documents.

Get multiple JSON documents by ID from one or more indices. If you specify an index in the request URI, you only need to specify the document IDs in the request body. To ensure fast responses, this multi get (mget) API responds with partial results if one or more shards fail.

Endpoint documentation

client.mget({ ... })

Run multiple searches.

The format of the request is similar to the bulk API format and makes use of the newline delimited JSON (NDJSON) format. The structure is as follows:

header\n
body\n
header\n
body\n

This structure is specifically optimized to reduce parsing if a specific search ends up redirected to another node.

Endpoint documentation

client.msearch({ ... })

Run multiple templated searches.

Endpoint documentation

client.msearchTemplate({ ... })

Get multiple term vectors.

You can specify existing documents by index and ID or provide artificial documents in the body of the request. You can specify the index in the request body or request URI. The response contains a docs array with all the fetched termvectors. Each element has the structure provided by the termvectors API.

Endpoint documentation

client.mtermvectors({ ... })

Open a point in time.

A search request by default runs against the most recent visible data of the target indices, which is called point in time. Elasticsearch pit (point in time) is a lightweight view into the state of the data as it existed when initiated. In some cases, it’s preferred to perform multiple search requests using the same point in time. For example, if refreshes happen between search_after requests, then the results of those requests might not be consistent as changes happening between searches are only visible to the more recent point in time.

A point in time must be opened explicitly before being used in search requests. The keep_alive parameter tells Elasticsearch how long it should persist.

Endpoint documentation

client.openPointInTime({ index, keep_alive })

Ping the cluster. Get information about whether the cluster is running.

Endpoint documentation

client.ping()

Create or update a script or search template. Creates or updates a stored script or search template.

Endpoint documentation

client.putScript({ id, script })

Evaluate ranked search results.

Evaluate the quality of ranked search results over a set of typical search queries.

Endpoint documentation

client.rankEval({ requests })

Reindex documents. Copies documents from a source to a destination. The source can be any existing index, alias, or data stream. The destination must differ from the source. For example, you cannot reindex a data stream into itself.

Endpoint documentation

client.reindex({ dest, source })

Throttle a reindex operation.

Change the number of requests per second for a particular reindex operation.

Endpoint documentation

client.reindexRethrottle({ task_id })

Render a search template.

Render a search template as a search request body.

Endpoint documentation

client.renderSearchTemplate({ ... })

Run a script. Runs a script and returns a result.

Endpoint documentation

client.scriptsPainlessExecute({ ... })

Run a scrolling search.

The scroll API gets large sets of results from a single scrolling search request. To get the necessary scroll ID, submit a search API request that includes an argument for the scroll query parameter. The scroll parameter indicates how long Elasticsearch should retain the search context for the request. The search response returns a scroll ID in the _scroll_id response body parameter. You can then use the scroll ID with the scroll API to retrieve the next batch of results for the request. If the Elasticsearch security features are enabled, the access to the results of a specific scroll ID is restricted to the user or API key that submitted the search.

You can also use the scroll API to specify a new scroll parameter that extends or shortens the retention period for the search context.

Endpoint documentation

client.scroll({ scroll_id })

Run a search.

Get search hits that match the query defined in the request. You can provide search queries using the q query string parameter or the request body. If both are specified, only the query parameter is used.

Endpoint documentation

client.search({ ... })

Search a vector tile.

Search a vector tile for geospatial values.

Endpoint documentation

client.searchMvt({ index, field, zoom, x, y })

Supports the following aggregation types: - avg - cardinality - max - min - sum buffer (Optional, number): Size, in pixels, of a clipping buffer outside the tile. This allows renderers to avoid outline artifacts from geometries that extend past the extent of the tile. exact_bounds (Optional, boolean): If false, the meta layer’s feature is the bounding box of the tile. If true, the meta layer’s feature is a bounding box resulting from a geo_bounds aggregation. The aggregation runs on <field> values that intersect the <zoom>/<x>/<y> tile with wrap_longitude set to false. The resulting bounding box may be larger than the vector tile. extent (Optional, number): Size, in pixels, of a side of the tile. Vector tiles are square with equal sides. fields (Optional, string | string[]): Fields to return in the hits layer. Supports wildcards (*). This parameter does not support fields with array values. Fields with array values may return inconsistent results. grid_agg (Optional, Enum("geotile" | "geohex")): Aggregation used to create a grid for the field. grid_precision (Optional, number): Additional zoom levels available through the aggs layer. For example, if <zoom> is 7 and grid_precision is 8, you can zoom in up to level 15. Accepts 0-8. If 0, results don’t include the aggs layer. grid_type (Optional, Enum("grid" | "point" | "centroid")): Determines the geometry type for features in the aggs layer. In the aggs layer, each feature represents a geotile_grid cell. If grid each feature is a Polygon of the cells bounding box. If point each feature is a Point that is the centroid of the cell. query (Optional, { bool, boosting, common, combined_fields, constant_score, dis_max, distance_feature, exists, function_score, fuzzy, geo_bounding_box, geo_distance, geo_polygon, geo_shape, has_child, has_parent, ids, intervals, knn, match, match_all, match_bool_prefix, match_none, match_phrase, match_phrase_prefix, more_like_this, multi_match, nested, parent_id, percolate, pinned, prefix, query_string, range, rank_feature, regexp, rule, script, script_score, semantic, shape, simple_query_string, span_containing, span_field_masking, span_first, span_multi, span_near, span_not, span_or, span_term, span_within, sparse_vector, term, terms, terms_set, text_expansion, weighted_tokens, wildcard, wrapper, type }): Query DSL used to filter documents for the search. runtime_mappings (Optional, Record<string, { fields, fetch_fields, format, input_field, target_field, target_index, script, type }>): Defines one or more runtime fields in the search request. These fields take precedence over mapped fields with the same name. size (Optional, number): Maximum number of features to return in the hits layer. Accepts 0-10000. If 0, results don’t include the hits layer. sort (Optional, string | { _score, _doc, _geo_distance, _script } | string | { _score, _doc, _geo_distance, _script }[]): Sorts features in the hits layer. By default, the API calculates a bounding box for each feature. It sorts features based on this box’s diagonal length, from longest to shortest. track_total_hits (Optional, boolean | number): Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. * *with_labels (Optional, boolean): If true, the hits and aggs layers will contain additional point features representing suggested label positions for the original features.

Get the search shards.

Get the indices and shards that a search request would be run against. This information can be useful for working out issues or planning optimizations with routing and shard preferences. When filtered aliases are used, the filter is returned as part of the indices section.

Endpoint documentation

client.searchShards({ ... })

Run a search with a search template.

Endpoint documentation

client.searchTemplate({ ... })

Get terms in an index.

Discover terms that match a partial string in an index. This "terms enum" API is designed for low-latency look-ups used in auto-complete scenarios.

If the complete property in the response is false, the returned terms set may be incomplete and should be treated as approximate. This can occur due to a few reasons, such as a request timeout or a node error.

Endpoint documentation

client.termsEnum({ index, field })

Get term vector information.

Get information and statistics about terms in the fields of a particular document.

Endpoint documentation

client.termvectors({ index })

Update a document. Updates a document by running a script or passing a partial document.

Endpoint documentation

client.update({ id, index })

Update documents. Updates documents that match the specified query. If no query is specified, performs an update on every document in the data stream or index without modifying the source, which is useful for picking up mapping changes.

Endpoint documentation

client.updateByQuery({ index })

Throttle an update by query operation.

Change the number of requests per second for a particular update by query operation. Rethrottling that speeds up the query takes effect immediately but rethrotting that slows down the query takes effect after completing the current batch to prevent scroll timeouts.

Endpoint documentation

client.updateByQueryRethrottle({ task_id })

Delete an async search.

If the asynchronous search is still running, it is cancelled. Otherwise, the saved search results are deleted. If the Elasticsearch security features are enabled, the deletion of a specific async search is restricted to: the authenticated user that submitted the original search request; users that have the cancel_task cluster privilege.

Endpoint documentation

client.asyncSearch.delete({ id })

Get async search results.

Retrieve the results of a previously submitted asynchronous search request. If the Elasticsearch security features are enabled, access to the results of a specific async search is restricted to the user or API key that submitted it.

Endpoint documentation

client.asyncSearch.get({ id })

Get the async search status.

Get the status of a previously submitted async search request given its identifier, without retrieving search results. If the Elasticsearch security features are enabled, use of this API is restricted to the monitoring_user role.

Endpoint documentation

client.asyncSearch.status({ id })

Run an async search.

When the primary sort of the results is an indexed field, shards get sorted based on minimum and maximum value that they hold for that field. Partial results become available following the sort criteria that was requested.

Warning: Asynchronous search does not support scroll or search requests that include only the suggest section.

By default, Elasticsearch does not allow you to store an async search response larger than 10Mb and an attempt to do this results in an error. The maximum allowed size for a stored async search response can be set by changing the search.max_async_search_response_size cluster level setting.

Endpoint documentation

client.asyncSearch.submit({ ... })

Delete an autoscaling policy.

Endpoint documentation

client.autoscaling.deleteAutoscalingPolicy({ name })

Get the autoscaling capacity.

This API gets the current autoscaling capacity based on the configured autoscaling policy. It will return information to size the cluster appropriately to the current workload.

The required_capacity is calculated as the maximum of the required_capacity result of all individual deciders that are enabled for the policy.

The operator should verify that the current_nodes match the operator’s knowledge of the cluster to avoid making autoscaling decisions based on stale or incomplete information.

The response contains decider-specific information you can use to diagnose how and why autoscaling determined a certain capacity was required. This information is provided for diagnosis only. Do not use this information to make autoscaling decisions.

Endpoint documentation

client.autoscaling.getAutoscalingCapacity({ ... })

Get an autoscaling policy.

Endpoint documentation

client.autoscaling.getAutoscalingPolicy({ name })

Create or update an autoscaling policy.

Endpoint documentation

client.autoscaling.putAutoscalingPolicy({ name })

Get aliases. Retrieves the cluster’s index aliases, including filter and routing information. The API does not return data stream aliases.

CAT APIs are only intended for human consumption using the command line or the Kibana console. They are not intended for use by applications. For application consumption, use the aliases API.

Endpoint documentation

client.cat.aliases({ ... })

Get shard allocation information. Get a snapshot of the number of shards allocated to each data node and their disk space. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications.

Endpoint documentation

client.cat.allocation({ ... })

Get component templates. Returns information about component templates in a cluster. Component templates are building blocks for constructing index templates that specify index mappings, settings, and aliases.

CAT APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the get component template API.

Endpoint documentation

client.cat.componentTemplates({ ... })

Get a document count. Provides quick access to a document count for a data stream, an index, or an entire cluster. The document count only includes live documents, not deleted documents which have not yet been removed by the merge process.

CAT APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the count API.

Endpoint documentation

client.cat.count({ ... })

Get field data cache information. Get the amount of heap memory currently used by the field data cache on every data node in the cluster. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the nodes stats API.

Endpoint documentation

client.cat.fielddata({ ... })

Get the cluster health status. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the cluster health API. This API is often used to check malfunctioning clusters. To help you track cluster health alongside log files and alerting systems, the API returns timestamps in two formats: HH:MM:SS, which is human-readable but includes no date information; Unix epoch time, which is machine-sortable and includes date information. The latter format is useful for cluster recoveries that take multiple days. You can use the cat health API to verify cluster health across multiple nodes. You also can use the API to track the recovery of a large cluster over a longer period of time.

Endpoint documentation

client.cat.health({ ... })

Get CAT help. Returns help for the CAT APIs.

Endpoint documentation

client.cat.help()

Get index information. Returns high-level information about indices in a cluster, including backing indices for data streams.

Use this request to get the following information for each index in a cluster: - shard count - document count - deleted document count - primary store size - total store size of all shards, including shard replicas

These metrics are retrieved directly from Lucene, which Elasticsearch uses internally to power indexing and search. As a result, all document counts include hidden nested documents. To get an accurate count of Elasticsearch documents, use the cat count or count APIs.

CAT APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use an index endpoint.

Endpoint documentation

client.cat.indices({ ... })

Get master node information. Get information about the master node, including the ID, bound IP address, and name. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the nodes info API.

Endpoint documentation

client.cat.master({ ... })

Get data frame analytics jobs. Returns configuration and usage information about data frame analytics jobs.

CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get data frame analytics jobs statistics API.

Endpoint documentation

client.cat.mlDataFrameAnalytics({ ... })

Get datafeeds. Returns configuration and usage information about datafeeds. This API returns a maximum of 10,000 datafeeds. If the Elasticsearch security features are enabled, you must have monitor_ml, monitor, manage_ml, or manage cluster privileges to use this API.

CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get datafeed statistics API.

Endpoint documentation

client.cat.mlDatafeeds({ ... })

If true, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches. h (Optional, Enum("ae" | "bc" | "id" | "na" | "ne" | "ni" | "nn" | "sba" | "sc" | "seah" | "st" | "s") | Enum("ae" | "bc" | "id" | "na" | "ne" | "ni" | "nn" | "sba" | "sc" | "seah" | "st" | "s")[]): List of column names to display. s (Optional, Enum("ae" | "bc" | "id" | "na" | "ne" | "ni" | "nn" | "sba" | "sc" | "seah" | "st" | "s") | Enum("ae" | "bc" | "id" | "na" | "ne" | "ni" | "nn" | "sba" | "sc" | "seah" | "st" | "s")[]): List of column names or column aliases used to sort the response. * *time (Optional, Enum("nanos" | "micros" | "ms" | "s" | "m" | "h" | "d")): The unit used to display time values.

Get anomaly detection jobs. Returns configuration and usage information for anomaly detection jobs. This API returns a maximum of 10,000 jobs. If the Elasticsearch security features are enabled, you must have monitor_ml, monitor, manage_ml, or manage cluster privileges to use this API.

CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get anomaly detection job statistics API.

Endpoint documentation

client.cat.mlJobs({ ... })

If true, the API returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches. bytes (Optional, Enum("b" | "kb" | "mb" | "gb" | "tb" | "pb")): The unit used to display byte values. h (Optional, Enum("assignment_explanation" | "buckets.count" | "buckets.time.exp_avg" | "buckets.time.exp_avg_hour" | "buckets.time.max" | "buckets.time.min" | "buckets.time.total" | "data.buckets" | "data.earliest_record" | "data.empty_buckets" | "data.input_bytes" | "data.input_fields" | "data.input_records" | "data.invalid_dates" | "data.last" | "data.last_empty_bucket" | "data.last_sparse_bucket" | "data.latest_record" | "data.missing_fields" | "data.out_of_order_timestamps" | "data.processed_fields" | "data.processed_records" | "data.sparse_buckets" | "forecasts.memory.avg" | "forecasts.memory.max" | "forecasts.memory.min" | "forecasts.memory.total" | "forecasts.records.avg" | "forecasts.records.max" | "forecasts.records.min" | "forecasts.records.total" | "forecasts.time.avg" | "forecasts.time.max" | "forecasts.time.min" | "forecasts.time.total" | "forecasts.total" | "id" | "model.bucket_allocation_failures" | "model.by_fields" | "model.bytes" | "model.bytes_exceeded" | "model.categorization_status" | "model.categorized_doc_count" | "model.dead_category_count" | "model.failed_category_count" | "model.frequent_category_count" | "model.log_time" | "model.memory_limit" | "model.memory_status" | "model.over_fields" | "model.partition_fields" | "model.rare_category_count" | "model.timestamp" | "model.total_category_count" | "node.address" | "node.ephemeral_id" | "node.id" | "node.name" | "opened_time" | "state") | Enum("assignment_explanation" | "buckets.count" | "buckets.time.exp_avg" | "buckets.time.exp_avg_hour" | "buckets.time.max" | "buckets.time.min" | "buckets.time.total" | "data.buckets" | "data.earliest_record" | "data.empty_buckets" | "data.input_bytes" | "data.input_fields" | "data.input_records" | "data.invalid_dates" | "data.last" | "data.last_empty_bucket" | "data.last_sparse_bucket" | "data.latest_record" | "data.missing_fields" | "data.out_of_order_timestamps" | "data.processed_fields" | "data.processed_records" | "data.sparse_buckets" | "forecasts.memory.avg" | "forecasts.memory.max" | "forecasts.memory.min" | "forecasts.memory.total" | "forecasts.records.avg" | "forecasts.records.max" | "forecasts.records.min" | "forecasts.records.total" | "forecasts.time.avg" | "forecasts.time.max" | "forecasts.time.min" | "forecasts.time.total" | "forecasts.total" | "id" | "model.bucket_allocation_failures" | "model.by_fields" | "model.bytes" | "model.bytes_exceeded" | "model.categorization_status" | "model.categorized_doc_count" | "model.dead_category_count" | "model.failed_category_count" | "model.frequent_category_count" | "model.log_time" | "model.memory_limit" | "model.memory_status" | "model.over_fields" | "model.partition_fields" | "model.rare_category_count" | "model.timestamp" | "model.total_category_count" | "node.address" | "node.ephemeral_id" | "node.id" | "node.name" | "opened_time" | "state")[]): List of column names to display. s (Optional, Enum("assignment_explanation" | "buckets.count" | "buckets.time.exp_avg" | "buckets.time.exp_avg_hour" | "buckets.time.max" | "buckets.time.min" | "buckets.time.total" | "data.buckets" | "data.earliest_record" | "data.empty_buckets" | "data.input_bytes" | "data.input_fields" | "data.input_records" | "data.invalid_dates" | "data.last" | "data.last_empty_bucket" | "data.last_sparse_bucket" | "data.latest_record" | "data.missing_fields" | "data.out_of_order_timestamps" | "data.processed_fields" | "data.processed_records" | "data.sparse_buckets" | "forecasts.memory.avg" | "forecasts.memory.max" | "forecasts.memory.min" | "forecasts.memory.total" | "forecasts.records.avg" | "forecasts.records.max" | "forecasts.records.min" | "forecasts.records.total" | "forecasts.time.avg" | "forecasts.time.max" | "forecasts.time.min" | "forecasts.time.total" | "forecasts.total" | "id" | "model.bucket_allocation_failures" | "model.by_fields" | "model.bytes" | "model.bytes_exceeded" | "model.categorization_status" | "model.categorized_doc_count" | "model.dead_category_count" | "model.failed_category_count" | "model.frequent_category_count" | "model.log_time" | "model.memory_limit" | "model.memory_status" | "model.over_fields" | "model.partition_fields" | "model.rare_category_count" | "model.timestamp" | "model.total_category_count" | "node.address" | "node.ephemeral_id" | "node.id" | "node.name" | "opened_time" | "state") | Enum("assignment_explanation" | "buckets.count" | "buckets.time.exp_avg" | "buckets.time.exp_avg_hour" | "buckets.time.max" | "buckets.time.min" | "buckets.time.total" | "data.buckets" | "data.earliest_record" | "data.empty_buckets" | "data.input_bytes" | "data.input_fields" | "data.input_records" | "data.invalid_dates" | "data.last" | "data.last_empty_bucket" | "data.last_sparse_bucket" | "data.latest_record" | "data.missing_fields" | "data.out_of_order_timestamps" | "data.processed_fields" | "data.processed_records" | "data.sparse_buckets" | "forecasts.memory.avg" | "forecasts.memory.max" | "forecasts.memory.min" | "forecasts.memory.total" | "forecasts.records.avg" | "forecasts.records.max" | "forecasts.records.min" | "forecasts.records.total" | "forecasts.time.avg" | "forecasts.time.max" | "forecasts.time.min" | "forecasts.time.total" | "forecasts.total" | "id" | "model.bucket_allocation_failures" | "model.by_fields" | "model.bytes" | "model.bytes_exceeded" | "model.categorization_status" | "model.categorized_doc_count" | "model.dead_category_count" | "model.failed_category_count" | "model.frequent_category_count" | "model.log_time" | "model.memory_limit" | "model.memory_status" | "model.over_fields" | "model.partition_fields" | "model.rare_category_count" | "model.timestamp" | "model.total_category_count" | "node.address" | "node.ephemeral_id" | "node.id" | "node.name" | "opened_time" | "state")[]): List of column names or column aliases used to sort the response. time (Optional, Enum("nanos" | "micros" | "ms" | "s" | "m" | "h" | "d")): The unit used to display time values.

Get trained models. Returns configuration and usage information about inference trained models.

CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get trained models statistics API.

Endpoint documentation

client.cat.mlTrainedModels({ ... })

Get node attribute information. Get information about custom node attributes. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the nodes info API.

Endpoint documentation

client.cat.nodeattrs({ ... })

Get node information. Get information about the nodes in a cluster. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the nodes info API.

Endpoint documentation

client.cat.nodes({ ... })

Get pending task information. Get information about cluster-level changes that have not yet taken effect. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the pending cluster tasks API.

Endpoint documentation

client.cat.pendingTasks({ ... })

Get plugin information. Get a list of plugins running on each node of a cluster. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the nodes info API.

Endpoint documentation

client.cat.plugins({ ... })

Get shard recovery information. Get information about ongoing and completed shard recoveries. Shard recovery is the process of initializing a shard copy, such as restoring a primary shard from a snapshot or syncing a replica shard from a primary shard. When a shard recovery completes, the recovered shard is available for search and indexing. For data streams, the API returns information about the stream’s backing indices. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the index recovery API.

Endpoint documentation

client.cat.recovery({ ... })

Get snapshot repository information. Get a list of snapshot repositories for a cluster. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the get snapshot repository API.

Endpoint documentation

client.cat.repositories()

Get segment information. Get low-level information about the Lucene segments in index shards. For data streams, the API returns information about the backing indices. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the index segments API.

Endpoint documentation

client.cat.segments({ ... })

Get shard information. Get information about the shards in a cluster. For data streams, the API returns information about the backing indices. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications.

Endpoint documentation

client.cat.shards({ ... })

Get snapshot information Get information about the snapshots stored in one or more repositories. A snapshot is a backup of an index or running Elasticsearch cluster. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the get snapshot API.

Endpoint documentation

client.cat.snapshots({ ... })

Get task information. Get information about tasks currently running in the cluster. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the task management API.

Endpoint documentation

client.cat.tasks({ ... })

Get index template information. Get information about the index templates in a cluster. You can use index templates to apply index settings and field mappings to new indices at creation. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the get index template API.

Endpoint documentation

client.cat.templates({ ... })

Get thread pool statistics. Get thread pool statistics for each node in a cluster. Returned information includes all built-in thread pools and custom thread pools. IMPORTANT: cat APIs are only intended for human consumption using the command line or Kibana console. They are not intended for use by applications. For application consumption, use the nodes info API.

Endpoint documentation

client.cat.threadPool({ ... })

Get transform information. Get configuration and usage information about transforms.

CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get transform statistics API.

Endpoint documentation

client.cat.transforms({ ... })

Deletes auto-follow patterns.

Endpoint documentation

client.ccr.deleteAutoFollowPattern({ name })

Creates a new follower index configured to follow the referenced leader index.

Endpoint documentation

client.ccr.follow({ index, leader_index, remote_cluster })

Retrieves information about all follower indices, including parameters and status for each follower index

Endpoint documentation

client.ccr.followInfo({ index })

Retrieves follower stats. return shard-level stats about the following tasks associated with each shard for the specified indices.

Endpoint documentation

client.ccr.followStats({ index })

Removes the follower retention leases from the leader.

Endpoint documentation

client.ccr.forgetFollower({ index })

Gets configured auto-follow patterns. Returns the specified auto-follow pattern collection.

Endpoint documentation

client.ccr.getAutoFollowPattern({ ... })

Pauses an auto-follow pattern

Endpoint documentation

client.ccr.pauseAutoFollowPattern({ name })

Pauses a follower index. The follower index will not fetch any additional operations from the leader index.

Endpoint documentation

client.ccr.pauseFollow({ index })

Creates a new named collection of auto-follow patterns against a specified remote cluster. Newly created indices on the remote cluster matching any of the specified patterns will be automatically configured as follower indices.

Endpoint documentation

client.ccr.putAutoFollowPattern({ name, remote_cluster })

Resumes an auto-follow pattern that has been paused

Endpoint documentation

client.ccr.resumeAutoFollowPattern({ name })

Resumes a follower index that has been paused

Endpoint documentation

client.ccr.resumeFollow({ index })

Gets all stats related to cross-cluster replication.

Endpoint documentation

client.ccr.stats()

Stops the following task associated with a follower index and removes index metadata and settings associated with cross-cluster replication.

Endpoint documentation

client.ccr.unfollow({ index })

Explain the shard allocations. Get explanations for shard allocations in the cluster. For unassigned shards, it provides an explanation for why the shard is unassigned. For assigned shards, it provides an explanation for why the shard is remaining on its current node and has not moved or rebalanced to another node. This API can be very useful when attempting to diagnose why a shard is unassigned or why a shard continues to remain on its current node when you might expect otherwise.

Endpoint documentation

client.cluster.allocationExplain({ ... })

Delete component templates. Deletes component templates. Component templates are building blocks for constructing index templates that specify index mappings, settings, and aliases.

Endpoint documentation

client.cluster.deleteComponentTemplate({ name })

Clear cluster voting config exclusions. Remove master-eligible nodes from the voting configuration exclusion list.

Endpoint documentation

client.cluster.deleteVotingConfigExclusions({ ... })

Check component templates. Returns information about whether a particular component template exists.

Endpoint documentation

client.cluster.existsComponentTemplate({ name })

Get component templates. Retrieves information about component templates.

Endpoint documentation

client.cluster.getComponentTemplate({ ... })

Get cluster-wide settings. By default, it returns only settings that have been explicitly defined.

Endpoint documentation

client.cluster.getSettings({ ... })

Get the cluster health status. You can also use the API to get the health status of only specified data streams and indices. For data streams, the API retrieves the health status of the stream’s backing indices.

The cluster health status is: green, yellow or red. On the shard level, a red status indicates that the specific shard is not allocated in the cluster. Yellow means that the primary shard is allocated but replicas are not. Green means that all shards are allocated. The index level status is controlled by the worst shard status.

One of the main benefits of the API is the ability to wait until the cluster reaches a certain high watermark health level. The cluster status is controlled by the worst index status.

Endpoint documentation

client.cluster.health({ ... })

Get cluster info. Returns basic information about the cluster.

Endpoint documentation

client.cluster.info({ target })

Get the pending cluster tasks. Get information about cluster-level changes (such as create index, update mapping, allocate or fail shard) that have not yet taken effect.

Endpoint documentation

client.cluster.pendingTasks({ ... })

Update voting configuration exclusions. Update the cluster voting config exclusions by node IDs or node names. By default, if there are more than three master-eligible nodes in the cluster and you remove fewer than half of the master-eligible nodes in the cluster at once, the voting configuration automatically shrinks. If you want to shrink the voting configuration to contain fewer than three nodes or to remove half or more of the master-eligible nodes in the cluster at once, use this API to remove departing nodes from the voting configuration manually. The API adds an entry for each specified node to the cluster’s voting configuration exclusions list. It then waits until the cluster has reconfigured its voting configuration to exclude the specified nodes.

Clusters should have no voting configuration exclusions in normal operation. Once the excluded nodes have stopped, clear the voting configuration exclusions with DELETE /_cluster/voting_config_exclusions. This API waits for the nodes to be fully removed from the cluster before it returns. If your cluster has voting configuration exclusions for nodes that you no longer intend to remove, use DELETE /_cluster/voting_config_exclusions?wait_for_removal=false to clear the voting configuration exclusions without waiting for the nodes to leave the cluster.

A response to POST /_cluster/voting_config_exclusions with an HTTP status code of 200 OK guarantees that the node has been removed from the voting configuration and will not be reinstated until the voting configuration exclusions are cleared by calling DELETE /_cluster/voting_config_exclusions. If the call to POST /_cluster/voting_config_exclusions fails or returns a response with an HTTP status code other than 200 OK then the node may not have been removed from the voting configuration. In that case, you may safely retry the call.

Endpoint documentation

client.cluster.postVotingConfigExclusions({ ... })

Create or update a component template. Creates or updates a component template. Component templates are building blocks for constructing index templates that specify index mappings, settings, and aliases.

An index template can be composed of multiple component templates. To use a component template, specify it in an index template’s composed_of list. Component templates are only applied to new data streams and indices as part of a matching index template.

Settings and mappings specified directly in the index template or the create index request override any settings or mappings specified in a component template.

Component templates are only used during index creation. For data streams, this includes data stream creation and the creation of a stream’s backing indices. Changes to component templates do not affect existing indices, including a stream’s backing indices.

You can use C-style /* *\/ block comments in component templates. You can include comments anywhere in the request body except before the opening curly bracket.

Endpoint documentation

client.cluster.putComponentTemplate({ name, template })

Update the cluster settings. Configure and update dynamic settings on a running cluster. You can also configure dynamic settings locally on an unstarted or shut down node in elasticsearch.yml.

Updates made with this API can be persistent, which apply across cluster restarts, or transient, which reset after a cluster restart. You can also reset transient or persistent settings by assigning them a null value.

If you configure the same setting using multiple methods, Elasticsearch applies the settings in following order of precedence: 1) Transient setting; 2) Persistent setting; 3) elasticsearch.yml setting; 4) Default setting value. For example, you can apply a transient setting to override a persistent setting or elasticsearch.yml setting. However, a change to an elasticsearch.yml setting will not override a defined transient or persistent setting.

Endpoint documentation

client.cluster.putSettings({ ... })

Get remote cluster information. Get all of the configured remote cluster information. This API returns connection and endpoint information keyed by the configured remote cluster alias.

Endpoint documentation

client.cluster.remoteInfo()

Reroute the cluster. Manually change the allocation of individual shards in the cluster. For example, a shard can be moved from one node to another explicitly, an allocation can be canceled, and an unassigned shard can be explicitly allocated to a specific node.

It is important to note that after processing any reroute commands Elasticsearch will perform rebalancing as normal (respecting the values of settings such as cluster.routing.rebalance.enable) in order to remain in a balanced state. For example, if the requested allocation includes moving a shard from node1 to node2 then this may cause a shard to be moved from node2 back to node1 to even things out.

The cluster can be set to disable allocations using the cluster.routing.allocation.enable setting. If allocations are disabled then the only allocations that will be performed are explicit ones given using the reroute command, and consequent allocations due to rebalancing.

The cluster will attempt to allocate a shard a maximum of index.allocation.max_retries times in a row (defaults to 5), before giving up and leaving the shard unallocated. This scenario can be caused by structural problems such as having an analyzer which refers to a stopwords file which doesn’t exist on all nodes.

Once the problem has been corrected, allocation can be manually retried by calling the reroute API with the ?retry_failed URI query parameter, which will attempt a single retry round for these shards.

Endpoint documentation

client.cluster.reroute({ ... })

Get the cluster state. Get comprehensive information about the state of the cluster.

The cluster state is an internal data structure which keeps track of a variety of information needed by every node, including the identity and attributes of the other nodes in the cluster; cluster-wide settings; index metadata, including the mapping and settings for each index; the location and status of every shard copy in the cluster.

The elected master node ensures that every node in the cluster has a copy of the same cluster state. This API lets you retrieve a representation of this internal state for debugging or diagnostic purposes. You may need to consult the Elasticsearch source code to determine the precise meaning of the response.

By default the API will route requests to the elected master node since this node is the authoritative source of cluster states. You can also retrieve the cluster state held on the node handling the API request by adding the ?local=true query parameter.

Elasticsearch may need to expend significant effort to compute a response to this API in larger clusters, and the response may comprise a very large quantity of data. If you use this API repeatedly, your cluster may become unstable.

Endpoint documentation

client.cluster.state({ ... })

Get cluster statistics. Get basic index metrics (shard numbers, store size, memory usage) and information about the current nodes that form the cluster (number, roles, os, jvm versions, memory usage, cpu and installed plugins).

Endpoint documentation

client.cluster.stats({ ... })

Check in a connector.

Update the last_seen field in the connector and set it to the current timestamp.

Endpoint documentation

client.connector.checkIn({ connector_id })

Delete a connector.

Removes a connector and associated sync jobs. This is a destructive action that is not recoverable. NOTE: This action doesn’t delete any API keys, ingest pipelines, or data indices associated with the connector. These need to be removed manually.

Endpoint documentation

client.connector.delete({ connector_id })

Get a connector.

Get the details about a connector.

Endpoint documentation

client.connector.get({ connector_id })

Get all connectors.

Get information about all connectors.

Endpoint documentation

client.connector.list({ ... })

Create a connector.

Connectors are Elasticsearch integrations that bring content from third-party data sources, which can be deployed on Elastic Cloud or hosted on your own infrastructure. Elastic managed connectors (Native connectors) are a managed service on Elastic Cloud. Self-managed connectors (Connector clients) are self-managed on your infrastructure.

Endpoint documentation

client.connector.post({ ... })

Create or update a connector.

Endpoint documentation

client.connector.put({ ... })

Cancel a connector sync job.

Cancel a connector sync job, which sets the status to cancelling and updates cancellation_requested_at to the current time. The connector service is then responsible for setting the status of connector sync jobs to cancelled.

Endpoint documentation

client.connector.syncJobCancel({ connector_sync_job_id })

Checks in a connector sync job (refreshes last_seen).

Endpoint documentation

client.connector.syncJobCheckIn()

Claims a connector sync job.

client.connector.syncJobClaim()

Delete a connector sync job.

Remove a connector sync job and its associated data. This is a destructive action that is not recoverable.

Endpoint documentation

client.connector.syncJobDelete({ connector_sync_job_id })

Sets an error for a connector sync job.

Endpoint documentation

client.connector.syncJobError()

Get a connector sync job.

Endpoint documentation

client.connector.syncJobGet({ connector_sync_job_id })

Get all connector sync jobs.

Get information about all stored connector sync jobs listed by their creation date in ascending order.

Endpoint documentation

client.connector.syncJobList({ ... })

Create a connector sync job.

Create a connector sync job document in the internal index and initialize its counters and timestamps with default values.

Endpoint documentation

client.connector.syncJobPost({ id })

Updates the stats fields in the connector sync job document.

Endpoint documentation

client.connector.syncJobUpdateStats()

Activate the connector draft filter.

Activates the valid draft filtering for a connector.

Endpoint documentation

client.connector.updateActiveFiltering({ connector_id })

Update the connector API key ID.

Update the api_key_id and api_key_secret_id fields of a connector. You can specify the ID of the API key used for authorization and the ID of the connector secret where the API key is stored. The connector secret ID is required only for Elastic managed (native) connectors. Self-managed connectors (connector clients) do not use this field.

Endpoint documentation

client.connector.updateApiKeyId({ connector_id })

Update the connector configuration.

Update the configuration field in the connector document.

Endpoint documentation

client.connector.updateConfiguration({ connector_id })

Update the connector error field.

Set the error field for the connector. If the error provided in the request body is non-null, the connector’s status is updated to error. Otherwise, if the error is reset to null, the connector status is updated to connected.

Endpoint documentation

client.connector.updateError({ connector_id, error })

Updates the connector features in the connector document.

Endpoint documentation

client.connector.updateFeatures()

Update the connector filtering.

Update the draft filtering configuration of a connector and marks the draft validation state as edited. The filtering draft is activated once validated by the running Elastic connector service. The filtering property is used to configure sync rules (both basic and advanced) for a connector.

Endpoint documentation

client.connector.updateFiltering({ connector_id })

Update the connector draft filtering validation.

Update the draft filtering validation info for a connector.

client.connector.updateFilteringValidation({ connector_id, validation })

Update the connector index name.

Update the index_name field of a connector, specifying the index where the data ingested by the connector is stored.

Endpoint documentation

client.connector.updateIndexName({ connector_id, index_name })

Update the connector name and description.

Endpoint documentation

client.connector.updateName({ connector_id })

Update the connector is_native flag.

client.connector.updateNative({ connector_id, is_native })

Update the connector pipeline.

When you create a new connector, the configuration of an ingest pipeline is populated with default settings.

Endpoint documentation

client.connector.updatePipeline({ connector_id, pipeline })

Update the connector scheduling.

Endpoint documentation

client.connector.updateScheduling({ connector_id, scheduling })

Update the connector service type.

Endpoint documentation

client.connector.updateServiceType({ connector_id, service_type })

Update the connector status.

Endpoint documentation

client.connector.updateStatus({ connector_id, status })

Delete a dangling index.

If Elasticsearch encounters index data that is absent from the current cluster state, those indices are considered to be dangling. For example, this can happen if you delete more than cluster.indices.tombstones.size indices while an Elasticsearch node is offline.

Endpoint documentation

client.danglingIndices.deleteDanglingIndex({ index_uuid, accept_data_loss })

Import a dangling index.

If Elasticsearch encounters index data that is absent from the current cluster state, those indices are considered to be dangling. For example, this can happen if you delete more than cluster.indices.tombstones.size indices while an Elasticsearch node is offline.

Endpoint documentation

client.danglingIndices.importDanglingIndex({ index_uuid, accept_data_loss })

Get the dangling indices.

If Elasticsearch encounters index data that is absent from the current cluster state, those indices are considered to be dangling. For example, this can happen if you delete more than cluster.indices.tombstones.size indices while an Elasticsearch node is offline.

Use this API to list dangling indices, which you can then import or delete.

Endpoint documentation

client.danglingIndices.listDanglingIndices()

Delete an enrich policy. Deletes an existing enrich policy and its enrich index.

Endpoint documentation

client.enrich.deletePolicy({ name })

Run an enrich policy. Create the enrich index for an existing enrich policy.

Endpoint documentation

client.enrich.executePolicy({ name })

Get an enrich policy. Returns information about an enrich policy.

Endpoint documentation

client.enrich.getPolicy({ ... })

Create an enrich policy. Creates an enrich policy.

Endpoint documentation

client.enrich.putPolicy({ name })

Get enrich stats. Returns enrich coordinator statistics and information about enrich policies that are currently executing.

Endpoint documentation

client.enrich.stats()

Delete an async EQL search. Delete an async EQL search or a stored synchronous EQL search. The API also deletes results for the search.

Endpoint documentation

client.eql.delete({ id })

Get async EQL search results. Get the current status and available results for an async EQL search or a stored synchronous EQL search.

Endpoint documentation

client.eql.get({ id })

Get the async EQL status. Get the current status for an async EQL search or a stored synchronous EQL search without returning results.

Endpoint documentation

client.eql.getStatus({ id })

Get EQL search results. Returns search results for an Event Query Language (EQL) query. EQL assumes each document in a data stream or index corresponds to an event.

Endpoint documentation

client.eql.search({ index, query })

Executes an ESQL request asynchronously

Endpoint documentation

client.esql.asyncQuery()

Retrieves the results of a previously submitted async query request given its ID.

Endpoint documentation

client.esql.asyncQueryGet()

Run an ES|QL query. Get search results for an ES|QL (Elasticsearch query language) query.

Endpoint documentation

client.esql.query({ query })

Gets a list of features which can be included in snapshots using the feature_states field when creating a snapshot

Endpoint documentation

client.features.getFeatures()

Resets the internal state of features, usually by deleting system indices

Endpoint documentation

client.features.resetFeatures()

Get global checkpoints. Get the current global checkpoints for an index. This API is designed for internal use by the Fleet server project.

Endpoint documentation

client.fleet.globalCheckpoints({ index })

Run multiple Fleet searches. Run several Fleet searches with a single API request. The API follows the same structure as the multi search API. However, similar to the Fleet search API, it supports the wait_for_checkpoints parameter.

client.fleet.msearch({ ... })

Run a Fleet search. The purpose of the Fleet search API is to provide an API where the search will be run only after the provided checkpoint has been processed and is visible for searches inside of Elasticsearch.

client.fleet.search({ index })

Explore graph analytics. Extract and summarize information about the documents and terms in an Elasticsearch data stream or index. The easiest way to understand the behavior of this API is to use the Graph UI to explore connections. An initial request to the _explore API contains a seed query that identifies the documents of interest and specifies the fields that define the vertices and connections you want to include in the graph. Subsequent requests enable you to spider out from one more vertices of interest. You can exclude vertices that have already been returned.

Endpoint documentation

client.graph.explore({ index })

Deletes the specified lifecycle policy definition. You cannot delete policies that are currently in use. If the policy is being used to manage any indices, the request fails and returns an error.

Endpoint documentation

client.ilm.deleteLifecycle({ policy })

Retrieves information about the index’s current lifecycle state, such as the currently executing phase, action, and step. Shows when the index entered each one, the definition of the running phase, and information about any failures.

Endpoint documentation

client.ilm.explainLifecycle({ index })

Retrieves a lifecycle policy.

Endpoint documentation

client.ilm.getLifecycle({ ... })

Retrieves the current index lifecycle management (ILM) status.

Endpoint documentation

client.ilm.getStatus()

Switches the indices, ILM policies, and legacy, composable and component templates from using custom node attributes and attribute-based allocation filters to using data tiers, and optionally deletes one legacy index template.+ Using node roles enables ILM to automatically move the indices between data tiers.

Endpoint documentation

client.ilm.migrateToDataTiers({ ... })

Manually moves an index into the specified step and executes that step.

Endpoint documentation

client.ilm.moveToStep({ index, current_step, next_step })