Elasticsearch

https://www.elastic.co/guide/en/elasticsearch/reference/7.16
Admin
Elasticsearch is a distributed, RESTful search and analytics engine designed for storing, searching,...
Tokens:7,826,154
Snippets:168,839
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Install Elasticsearch as a Windows Service

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/windows.html

Use these command-line options during installation to set up Elasticsearch as a service that starts automatically.

```bash
INSTALLASSERVICE=true
```

```bash
STARTAFTERINSTALL=true
```

```bash
STARTWHENWINDOWSSTARTS=true
```

--------------------------------

### Enable Elasticsearch Module and Setup Filebeat

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/configuring-filebeat.html

Enable the Elasticsearch module and run the setup command to initialize the Filebeat environment. This prepares Filebeat to process Elasticsearch logs.

```bash
filebeat modules enable elasticsearch
filebeat setup -e
```

--------------------------------

### Get Features API Response Example

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/get-features-api.html

The response lists features and their descriptions. Ensure the plugin defining a feature is installed on the master node for it to be recognized.

```json
{
    "features": [
        {
            "name": "tasks",
            "description": "Manages task results"
        },
        {
            "name": "kibana",
            "description": "Manages Kibana configuration and reports"
        }
    ]
}
```

--------------------------------

### Get autoscaling policy API Example

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/autoscaling-get-autoscaling-policy.html

This example demonstrates how to get an autoscaling policy named 'my_autoscaling_policy'. The API returns the policy's roles and deciders.

```http
GET /_autoscaling/policy/my_autoscaling_policy
```

```json
{
   "roles": <roles>,
   "deciders": <deciders>
}
```

--------------------------------

### Start basic license

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/start-basic.html

Use this API to start an indefinite basic license when you do not currently have a license. Requires `manage` cluster privileges.

```bash
POST /_license/start_basic
```

```json
{
  "basic_was_started": true,
  "acknowledged": true
}
```

--------------------------------

### Get user privileges API Response Example

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/security-api-get-user-privileges.html

This is an example response from the Get user privileges API, detailing the cluster, global, indices, applications, and run_as privileges for the user.

```json
{
  "cluster" : [
    "all"
  ],
  "global" : [ ],
  "indices" : [
    {
      "names" : [ "*" ],
      "privileges" : [ "all" ],
      "allow_restricted_indices" : true
    }
  ],
  "applications" : [
    {
      "application" : "*",
      "privileges" : [ "*" ],
      "resources" : [ "*" ]
    }
  ],
  "run_as" : [ "*" ]
}
```

--------------------------------

### Configure Elasticsearch to start on boot (SysV init)

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/rpm.html

Use the `chkconfig` command to add Elasticsearch as a service that starts automatically when the system boots up.

```bash
sudo chkconfig --add elasticsearch
```

--------------------------------

### Configure Elasticsearch to Start on Boot (systemd)

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/deb.html

Enable Elasticsearch to start automatically on system boot using `systemctl enable`. Ensure the daemon is reloaded first.

```bash
sudo /bin/systemctl daemon-reload
```

```bash
sudo /bin/systemctl enable elasticsearch.service
```

--------------------------------

### Start Kibana

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/security-minimal-setup.html

Execute this command to start the Kibana service. This is typically run from the Kibana installation directory.

```bash
./bin/kibana
```

--------------------------------

### Start Watcher Service

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/api-java.html

This example demonstrates how to start the Watcher service using the Watcher service API.

```java
WatcherServiceResponse watcherServiceResponse = watcherClient.prepareWatchService().start().get();
```

--------------------------------

### Install License via Curl

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/update-license.html

Install your license file using a curl command. Prepend '@' to the license file path to treat it as an input file. Replace placeholders with your actual credentials and cluster details.

```bash
curl -XPUT -u <user> 'http://<host>:<port>/_license' -H "Content-Type: application/json" -d @license.json
```

--------------------------------

### Get Snapshots by Name Pattern and Start Time

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/get-snapshot-api.html

Retrieves information for snapshots matching a name pattern and starting on or after a specific timestamp, sorted by start time.

```APIDOC
## GET /_snapshot/{repository}/{snapshot}

### Description
Retrieves information for snapshots matching a name pattern and starting on or after a specific timestamp, sorted by start time in ascending order.

### Method
GET

### Endpoint
/_snapshot/my_repository/snapshot_*?sort=start_time&from_sort_value=1577833200000

### Query Parameters
- **sort** (string) - Optional - The field to sort the results by. Defaults to start_time.
- **from_sort_value** (long) - Optional - The timestamp (in milliseconds since epoch) to start sorting from. Results will be returned with start times on or after this value.

### Response
#### Success Response (200)
- **snapshots** (array) - A list of snapshot objects.
  - **snapshot** (string) - The name of the snapshot.
  - **uuid** (string) - The UUID of the snapshot.
  - **repository** (string) - The repository where the snapshot is stored.
  - **version_id** (integer) - The version ID of Elasticsearch when the snapshot was taken.
  - **version** (string) - The version of Elasticsearch when the snapshot was taken.
  - **indices** (array) - A list of indices included in the snapshot.
  - **data_streams** (array) - A list of data streams included in the snapshot.
  - **feature_states** (array) - A list of feature states included in the snapshot.
  - **include_global_state** (boolean) - Whether the global state was included in the snapshot.
  - **state** (string) - The state of the snapshot (e.g., SUCCESS, FAILED).
  - **start_time** (string) - The start time of the snapshot in ISO 8601 format.
  - **start_time_in_millis** (long) - The start time of the snapshot in milliseconds since epoch.
  - **end_time** (string) - The end time of the snapshot in ISO 8601 format.
  - **end_time_in_millis** (long) - The end time of the snapshot in milliseconds since epoch.
  - **duration_in_millis** (long) - The duration of the snapshot in milliseconds.
  - **failures** (array) - A list of failures that occurred during the snapshot.
  - **shards** (object) - Information about the snapshot shards.
    - **total** (integer) - The total number of shards.
    - **failed** (integer) - The number of failed shards.
    - **successful** (integer) - The number of successful shards.
- **total** (integer) - The total number of snapshots available.
- **remaining** (integer) - The number of snapshots remaining to be returned.

#### Response Example
```json
{
  "snapshots": [
    {
      "snapshot": "snapshot_1",
      "uuid": "dKb54xw67gvdRctLCxSket",
      "repository": "my_repository",
      "version_id": <version_id>,
      "version": <version>,
      "indices": [],
      "data_streams": [],
      "feature_states": [],
      "include_global_state": true,
      "state": "SUCCESS",
      "start_time": "2020-07-06T21:55:18.128Z",
      "start_time_in_millis": 1593093628849,
      "end_time": "2020-07-06T21:55:18.129Z",
      "end_time_in_millis": 1593093628850,
      "duration_in_millis": 1,
      "failures": [],
      "shards": {
        "total": 0,
        "failed": 0,
        "successful": 0
      }
    },
    {
      "snapshot": "snapshot_2",
      "uuid": "vdRctLCxSketdKb54xw67g",
      "repository": "my_repository",
      "version_id": <version_id>,
      "version": <version>,
      "indices": [],
      "data_streams": [],
      "feature_states": [],
      "include_global_state": true,
      "state": "SUCCESS",
      "start_time": "2020-07-06T21:55:18.130Z",
      "start_time_in_millis": 1593093628851,
      "end_time": "2020-07-06T21:55:18.130Z",
      "end_time_in_millis": 1593093628851,
      "duration_in_millis": 0,
      "failures": [],
      "shards": {
        "total": 0,
        "failed": 0,
        "successful": 0
      }
    },
    {
      "snapshot": "snapshot_3",
      "uuid": "dRctdKb54xw67gvLCxSket",
      "repository": "my_repository",
      "version_id": <version_id>,
      "version": <version>,
      "indices": [],
      "data_streams": [],
      "feature_states": [],
      "include_global_state": true,
      "state": "SUCCESS",
      "start_time": "2020-07-06T21:55:18.129Z",
      "start_time_in_millis": 1593093628850,
      "end_time": "2020-07-06T21:55:18.129Z",
      "end_time_in_millis": 1593093628850,
      "duration_in_millis": 0,
      "failures": [],
      "shards": {
        "total": 0,
        "failed": 0,
        "successful": 0
      }
    }
  ],
  "total": 3,
  "remaining": 0
}
```
```

--------------------------------

### Start basic license with acknowledge

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/start-basic.html

Use this API to start an indefinite basic license when you currently have a license with more features than a basic license. You must pass the acknowledge parameter because you are losing features. Requires `manage` cluster privileges.

```bash
POST /_license/start_basic?acknowledge=true
```

```json
{
  "basic_was_started": true,
  "acknowledged": true
}
```

--------------------------------

### Info API Response Example

Source: https://www.elastic.co/guide/en/elasticsearch/reference/7.16/info-api.html

This is an example response from the Info API, detailing build information, license status, and the availability and enablement of various X-Pack features.

```json
{
   "build" : {
      "hash" : "2798b1a3ce779b3611bb53a0082d4d741e4d3168",
      "date" : "2015-04-07T13:34:42Z"
   },
   "license" : {
      "uid" : "893361dc-9749-4997-93cb-xxx",
      "type" : "trial",
      "mode" : "trial",
      "status" : "active",
      "expiry_date_in_millis" : 1542665112332
   },
   "features" : {
      "ccr" : {
        "available" : true,
        "enabled" : true
      },
     "aggregate_metric" : {
          "available" : true,
          "enabled" : true
      },
      "analytics" : {
          "available" : true,
          "enabled" : true
      },
      "enrich" : {
          "available" : true,
          "enabled" : true
      },
      "frozen_indices" : {
         "available" : true,
         "enabled" : true
      },
      "graph" : {
         "available" : true,
         "enabled" : true
      },
      "ilm" : {
         "available" : true,
         "enabled" : true
      },
      "logstash" : {
         "available" : true,
         "enabled" : true
      },
      "ml" : {
         "available" : true,
         "enabled" : true,
         "native_code_info" : {
           "version" : "7.13.0",
           "build_hash" : "99a07c016d5a73"
        }
      },
      "monitoring" : {
         "available" : true,
         "enabled" : true
      },
      "rollup": {
         "available": true,
         "enabled": true
      },
      "searchable_snapshots" : {
         "available" : true,
         "enabled" : true
      },
      "security" : {
         "available" : true,
         "enabled" : false
      },
      "slm" : {
         "available" : true,
         "enabled" : true
      },
      "spatial" : {
         "available" : true,
         "enabled" : true
      },
      "eql" : {
         "available" : true,
         "enabled" : true
      },
      "sql" : {
         "available" : true,
         "enabled" : true
      },
      "transform" : {
         "available" : true,
         "enabled" : true
      },
      "voting_only" : {
         "available" : true,
         "enabled" : true
      },
      "watcher" : {
         "available" : true,
         "enabled" : true
      },
      "data_streams" : {
         "available" : true,
         "enabled" : true
      },
      "data_tiers" : {
         "available" : true,
         "enabled" : true
      }
   },
   "tagline" : "You know, for X"
}
```
Tokens:
Raw