IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

Elasticsearch Guide

Elasticsearch Guide: other versions:
Elasticsearch introduction
- Data in: documents and indices
- Information out: search and analyze
- Scalability and resilience
Getting started with Elasticsearch
- Get Elasticsearch up and running
- Index some documents
- Start searching
- Analyze results with aggregations
- Where to go from here
Set up Elasticsearch
- Installing Elasticsearch
- Configuring Elasticsearch
- Important Elasticsearch configuration
- Important System Configuration
- Bootstrap Checks
- Starting Elasticsearch
- Stopping Elasticsearch
- Adding nodes to your cluster
- Full-cluster restart and rolling restart
- Set up X-Pack
- Configuring X-Pack Java Clients
- Bootstrap Checks for X-Pack
Upgrade Elasticsearch
- Rolling upgrades
- Full cluster restart upgrade
- Reindex before upgrading
  - Reindex in place
  - Reindex from a remote cluster
Aggregations
- Metrics Aggregations
- Bucket Aggregations
- Pipeline Aggregations
- Matrix Aggregations
  - Matrix Stats
- Caching heavy aggregations
- Returning only aggregation results
- Aggregation Metadata
- Returning the type of the aggregation
- Indexing aggregation results with transforms
Query DSL
- Query and filter context
- Compound queries
- Full text queries
- Geo queries
- Shape queries
  - Shape
- Joining queries
  - Nested
  - Has child
  - Has parent
  - Parent ID
- Match all
- Span queries
- Specialized queries
- Term-level queries
  - Exists
  - Fuzzy
  - IDs
  - Prefix
  - Range
  - Regexp
  - Term
  - Terms
  - Terms set
  - Type Query
  - Wildcard
- minimum_should_match parameter
- rewrite parameter
- Regular expression syntax
Search across clusters
Scripting
- How to use scripts
- Accessing document fields and special variables
- Scripting and security
- Painless scripting language
- Lucene expressions language
- Advanced scripts using script engines
Mapping
- Removal of mapping types
- Field datatypes
  - Alias
  - Arrays
  - Binary
  - Boolean
  - Date
  - Date nanoseconds
  - Dense vector
  - Histogram
  - Flattened
  - Geo-point
  - Geo-shape
  - IP
  - Join
  - Keyword
  - Nested
  - Numeric
  - Object
  - Percolator
  - Range
  - Rank feature
  - Rank features
  - Search-as-you-type
  - Sparse vector
  - Text
  - Token count
  - Shape
- Meta-Fields
- Mapping parameters
- Dynamic Mapping
  - Dynamic field mapping
  - Dynamic templates
Text analysis
- Overview
- Concepts
- Configure text analysis
- Built-in analyzer reference
- Tokenizer reference
- Token filter reference
- Character filters reference
- Normalizers
Modules
- Discovery and cluster formation
- Shard allocation and cluster-level routing
- Local Gateway
  - Dangling indices
- HTTP
- Indices
- Network Settings
- Node
- Plugins
- Thread Pool
- Transport
- Remote clusters
Index modules
- Analysis
- Index Shard Allocation
- Mapper
- Merge
- Similarity module
- Slow Log
- Store
  - Preloading data into the file system cache
- Translog
- History retention
- Index Sorting
  - Use index sorting to speed up conjunctions
Ingest node
- Pipeline Definition
- Accessing Data in Pipelines
- Conditional Execution in Pipelines
- Handling Failures in Pipelines
- Enrich your data
- Processors
ILM: Manage the index lifecycle
- Overview
- Concepts
- Automate rollover
- Index lifecycle actions
  - Allocate
  - Delete
  - Force merge
  - Freeze
  - Read only
  - Rollover
  - Set priority
  - Shrink
  - Unfollow
  - Wait for snapshot
- Configure lifecycle policy
- Index lifecycle error handling
- Start and stop index lifecycle management
- Configure rollover
  - Skipping Rollover
- Manage existing indices
  - Managing existing periodic indices with ILM
  - Reindexing via ILM
- Restore a managed index
SQL access
- Overview
- Getting Started with SQL
- Conventions and Terminology
  - Mapping concepts across SQL and Elasticsearch
- Security
- SQL REST API
- SQL Translate API
- SQL CLI
- SQL JDBC
  - API usage
- SQL ODBC
  - Driver installation
  - Configuration
- SQL Client Applications
- SQL Language
- Functions and Operators
- Reserved keywords
- SQL Limitations
Monitor a cluster
- Overview
- How it works
- Monitoring in a production environment
- Elastic Stack Monitoring Service
- Collecting monitoring data
  - Pausing data collection
- Collecting monitoring data with Metricbeat
- Collecting log data with Filebeat
- Configuring indices for monitoring
- Collectors
- Exporters
  - Local exporters
  - HTTP exporters
- Troubleshooting
Frozen indices
- Best practices
- Searching a frozen index
- Monitoring frozen indices
Roll up or transform your data
- Rolling up historical data
- Transforming data
Set up a cluster for high availability
- Back up a cluster
- Cross-cluster replication
Snapshot and restore
- Register repository
- Take a snapshot
- Restore a snapshot
- Monitor snapshot and restore
- SLM: Manage the snapshot lifecycle
  - Tutorial: Automate backups with SLM
  - Security and SLM
- Snapshot lifecycle management retention
Secure a cluster
- Overview
- Configuring security
- User authentication
- Configuring SAML single-sign-on on the Elastic Stack
- Configuring single sign-on to the Elastic Stack using OpenID Connect
- User authorization
- Enabling audit logging
- Encrypting communications
- Restricting connections with IP filtering
- Cross cluster search, clients, and integrations
- Tutorial: Getting started with security
- Tutorial: Encrypting communications
- Troubleshooting
- Limitations
Alerting on cluster and index events
- Getting started with Watcher
- How Watcher works
- Encrypting sensitive data in Watcher
- Inputs
- Triggers
  - Schedule trigger
- Conditions
- Actions
- Payload transforms
- Java API
- Managing watches
- Example watches
  - Watching the status of an Elasticsearch cluster
  - Watching event data
- Troubleshooting
- Limitations
Command line tools
- elasticsearch-certgen
- elasticsearch-certutil
- elasticsearch-croneval
  - Parameters
- elasticsearch-keystore
- elasticsearch-migrate
- elasticsearch-node
- elasticsearch-saml-metadata
- elasticsearch-setup-passwords
- elasticsearch-shard
- elasticsearch-syskeygen
- elasticsearch-users
How To
- General recommendations
- Recipes
- Tune for indexing speed
- Tune for search speed
- Tune for disk usage
- Avoid oversharding
Glossary of terms
REST APIs
- API conventions
  - Multiple indices
  - Date math support in index names
  - Cron expressions
  - Common options
  - URL-based access control
- cat APIs
  - cat aliases
  - cat allocation
  - cat count
  - cat fielddata
  - cat health
  - cat indices
  - cat master
  - cat nodeattrs
  - cat nodes
  - cat pending tasks
  - cat plugins
  - cat recovery
  - cat repositories
  - cat task management
  - cat thread pool
  - cat shards
  - cat segments
  - cat snapshots
  - cat templates
- Cluster APIs
  - Cluster allocation explain
  - Cluster get settings
  - Cluster health
  - Cluster reroute
  - Cluster state
  - Cluster stats
  - Cluster update settings
  - Nodes feature usage
  - Nodes hot threads
  - Nodes info
  - Nodes stats
  - Pending cluster tasks
  - Remote cluster info
  - Task management
  - Voting configuration exclusions
- Cross-cluster replication APIs
  - Get CCR stats
  - Create follower
  - Pause follower
  - Resume follower
  - Unfollow
  - Forget follower
  - Get follower stats
  - Get follower info
  - Create auto-follow pattern
  - Delete auto-follow pattern
  - Get auto-follow pattern
  - Pause auto-follow pattern
  - Resume auto-follow pattern
- Document APIs
  - Reading and Writing documents
  - Index
  - Get
  - Delete
  - Delete by query
  - Update
  - Update By Query API
  - Multi get
  - Bulk
  - Reindex
  - Term vectors
  - Multi term vectors
  - ?refresh
  - Optimistic concurrency control
- Enrich APIs
  - Put enrich policy
  - Delete enrich policy
  - Get enrich policy
  - Execute enrich policy
  - Enrich stats
- Explore API
- Index APIs
  - Add index alias
  - Analyze
  - Clear cache
  - Clone index
  - Close index
  - Create index
  - Delete index
  - Delete index alias
  - Delete index template
  - Flush
  - Force merge
  - Freeze index
  - Get field mapping
  - Get index
  - Get index alias
  - Get index settings
  - Get index template
  - Get mapping
  - Index alias exists
  - Index exists
  - Index recovery
  - Index segments
  - Index shard stores
  - Index stats
  - Index template exists
  - Open index
  - Put index template
  - Put mapping
  - Refresh
  - Rollover index
  - Shrink index
  - Split index
  - Synced flush
  - Type exists
  - Unfreeze index
  - Update index alias
  - Update index settings
- Index lifecycle management API
  - Create policy
  - Get policy
  - Delete policy
  - Move to step
  - Remove policy
  - Retry policy
  - Get index lifecycle management status
  - Explain lifecycle
  - Start index lifecycle management
  - Stop index lifecycle management
- Ingest APIs
  - Put pipeline
  - Get pipeline
  - Delete pipeline
  - Simulate pipeline
- Info API
- Licensing APIs
  - Delete license
  - Get license
  - Get trial status
  - Start trial
  - Get basic status
  - Start basic
  - Update license
- Machine learning anomaly detection APIs
  - Add events to calendar
  - Add jobs to calendar
  - Close jobs
  - Create jobs
  - Create calendar
  - Create datafeeds
  - Create filter
  - Delete calendar
  - Delete datafeeds
  - Delete events from calendar
  - Delete filter
  - Delete forecast
  - Delete jobs
  - Delete jobs from calendar
  - Delete model snapshots
  - Delete expired data
  - Find file structure
  - Flush jobs
  - Forecast jobs
  - Get buckets
  - Get calendars
  - Get categories
  - Get datafeeds
  - Get datafeed statistics
  - Get influencers
  - Get jobs
  - Get job statistics
  - Get machine learning info
  - Get model snapshots
  - Get overall buckets
  - Get scheduled events
  - Get filters
  - Get records
  - Open jobs
  - Post data to jobs
  - Preview datafeeds
  - Revert model snapshots
  - Set upgrade mode
  - Start datafeeds
  - Stop datafeeds
  - Update datafeeds
  - Update filter
  - Update jobs
  - Update model snapshots
- Machine learning data frame analytics APIs
  - Create data frame analytics jobs
  - Create inference trained model
  - Delete data frame analytics jobs
  - Delete inference trained model
  - Evaluate data frame analytics
  - Explain data frame analytics API
  - Get data frame analytics jobs
  - Get data frame analytics jobs stats
  - Get inference trained model
  - Get inference trained model stats
  - Start data frame analytics jobs
  - Stop data frame analytics jobs
- Migration APIs
  - Deprecation info
- Reload search analyzers
- Rollup APIs
  - Create rollup jobs
  - Delete rollup jobs
  - Get job
  - Get rollup caps
  - Get rollup index caps
  - Rollup search
  - Start rollup jobs
  - Stop rollup jobs
- Search APIs
  - Search
  - URI Search
  - Request Body Search
  - Search Template
  - Multi Search Template
  - Search Shards API
  - Suggesters
  - Multi Search API
  - Count API
  - Validate API
  - Explain API
  - Profile API
  - Field Capabilities API
  - Ranking Evaluation API
- Security APIs
  - Authenticate
  - Change passwords
  - Clear cache
  - Clear roles cache
  - Create API keys
  - Create or update application privileges
  - Create or update role mappings
  - Create or update roles
  - Create or update users
  - Delegate PKI authentication
  - Delete application privileges
  - Delete role mappings
  - Delete roles
  - Delete users
  - Disable users
  - Enable users
  - Get API key information
  - Get application privileges
  - Get builtin privileges
  - Get role mappings
  - Get roles
  - Get token
  - Get users
  - Has privileges
  - Invalidate API key
  - Invalidate token
  - OpenID Connect Prepare Authentication API
  - OpenID Connect authenticate API
  - OpenID Connect logout API
  - SAML prepare authentication API
  - SAML authenticate API
  - SAML logout API
  - SAML invalidate API
  - SSL certificate
- Snapshot and restore APIs
  - Clean up snapshot repository
- Snapshot lifecycle management API
  - Put policy
  - Get policy
  - Delete policy
  - Execute snapshot lifecycle policy
  - Execute snapshot retention policy
  - Get snapshot lifecycle management status
  - Get snapshot lifecycle stats
  - Start snapshot lifecycle management
  - Stop snapshot lifecycle management
- Transform APIs
  - Create transform
  - Update transform
  - Delete transform
  - Get transforms
  - Get transform statistics
  - Preview transform
  - Start transform
  - Stop transforms
- Usage API
- Watcher APIs
  - Ack watch
  - Activate watch
  - Deactivate watch
  - Delete watch
  - Execute watch
  - Get watch
  - Get Watcher stats
  - Put watch
  - Start watch service
  - Stop watch service
- Definitions
  - Role mapping resources
Release highlights
- 7.6.0
- 7.5.0
- 7.4.0
- 7.3.0
- 7.2.0
- 7.1.0
- 7.0.0
Breaking changes
- 7.6
- 7.5
- 7.4
- 7.3
- 7.2
- 7.1
- 7.0
Release notes
- Elasticsearch version 7.6.2
- Elasticsearch version 7.6.1
- Elasticsearch version 7.6.0
- Elasticsearch version 7.5.2
- Elasticsearch version 7.5.1
- Elasticsearch version 7.5.0
- Elasticsearch version 7.4.2
- Elasticsearch version 7.4.1
- Elasticsearch version 7.4.0
- Elasticsearch version 7.3.2
- Elasticsearch version 7.3.1
- Elasticsearch version 7.3.0
- Elasticsearch version 7.2.1
- Elasticsearch version 7.2.0
- Elasticsearch version 7.1.1
- Elasticsearch version 7.1.0
- Elasticsearch version 7.0.0
- Elasticsearch version 7.0.0-rc2
- Elasticsearch version 7.0.0-rc1
- Elasticsearch version 7.0.0-beta1
- Elasticsearch version 7.0.0-alpha2
- Elasticsearch version 7.0.0-alpha1

Elasticsearch introduction »