Execute an Elasticsearch search against an index or alias. Accepts a full Query DSL body (JSON string or object). Size is capped by server policy, a search timeout is injected, and deep paging is rejected. Returns hits, aggregations, timing and shard stats. Use search_after for pagination beyond 10k.

Count matching documents without returning hits. Cheap way to size a query before running it.

Build Elasticsearch Query DSL from a structured spec, then validate it against the real index. Supply spec as JSON with any of: text, text_fields, filters [{field, op, value}], must_not, should, time_field/time_from/time_to, sort, size, aggs [{name, type, field, size, interval}], highlight_fields, source_includes. Ops: eq, neq, in, not_in, gt, gte, lt, lte, exists, missing, prefix, wildcard, match, match_phrase. Returns the generated DSL plus validation result and a field catalog so you can correct field names before running it.

Explain a query three ways: (1) _validate/query?rewrite=true shows how ES rewrites it and why it may be invalid, (2) profile=true gives per-component timing to find the slow clause, (3) if doc_id is given, _explain shows why that document matched or did not, with scoring detail.

Open a point-in-time (PIT) against an index and return its pit_id. A PIT freezes the data view so you can page through a large result set consistently with paged_search, past the 10000 deep-paging limit. Always close it with close_pit when done; keep_alive controls how long ES holds it open.

Close a point-in-time by its pit_id to free cluster resources. Call after paging finishes.

Page through a large result set beyond the 10000 deep-paging limit using a point-in-time and search_after. First call: open_pit, then call this with the pit_id and a query; it returns one page plus next_search_after and the (possibly refreshed) pit_id. Pass both back on the next call to get the following page. A sort is required and an implicit _shard_doc tiebreak is added for stable ordering. No index argument: the PIT already binds the index. Close with close_pit at the end.

Cluster health overview: status, node counts, active/relocating/initializing/unassigned shards, pending tasks, and (optionally) per-index health. Start troubleshooting here.

Per-index health and size: status, docs, store size, primaries/replicas, segment count, refresh and merge stats, plus search/index throughput. Pass an index pattern to narrow it down.

Shard placement and why shards are unassigned. Returns _cat/shards, per-node disk usage, and for any UNASSIGNED shard the cluster allocation explanation (decider-level reasons: disk watermark, awareness, filtering, max_retries). This is the tool for a yellow/red cluster.

Find what is slow. Combines: indices ranked by average query latency (_stats), currently running search tasks with elapsed time (_tasks), search thread-pool queue/rejection counts per node, and the configured search slowlog thresholds per index (so you know whether slowlog is even on). Use top_n to control how many indices come back.

List cluster nodes with role, version, heap/RAM/CPU/load, and master flag. Use it to spot a hot node, a version mismatch across nodes, or which node is master.

Show the capabilities of one or more fields across indices via _field_caps: the type(s) each field has, whether it is searchable and aggregatable. The key use is catching a field mapped as different types in different indices (e.g. long in one, keyword in another), which breaks queries across an index pattern. Pass fields as a comma list or *.

List indices, data streams and aliases matching a pattern, with doc counts and store size.

Get the mapping for an index. Returns a flattened field catalog (field path -> type, including multi-fields like .keyword) which is what you need to write correct queries, plus dynamic templates and total field count. Set raw=true for the untouched mapping JSON.

Run text through an analyzer and see the resulting tokens. Use it when a match query returns nothing: it shows exactly how the field's analyzer tokenizes the indexed text vs your search term.

Add new fields to an existing index mapping. Only additive changes are possible in Elasticsearch; changing an existing field type requires reindex. Blocked unless the server runs with writes enabled, and requires confirm=true.

List registered snapshot repositories with their type and settings (bucket, base_path, ...).

List snapshots in a repository with state, start/end time, duration, indices count, shard failures and size. Use this before restoring to pick the right snapshot.

Detailed progress of running or recent snapshots: per-shard stage, bytes done vs total.

Create a snapshot of selected indices into a repository. Non-blocking by default: returns immediately, poll with snapshot_status. Requires writes enabled and confirm=true.

Restore indices from a snapshot. DESTRUCTIVE: an index that already exists must be closed or renamed via rename_pattern/rename_replacement, otherwise the restore fails. Requires writes enabled, ES_MCP_ALLOW_DESTRUCTIVE=true, and confirm=true.

Copy documents from a source index to a destination, optionally filtered by a query and transformed by a pipeline or script. Runs asynchronously (wait_for_completion=false) and returns a task_id to poll with get_task. Use this to change a field type, reshard, or migrate data. Requires writes enabled, ES_MCP_ALLOW_DESTRUCTIVE=true, and confirm=true.

Poll a long-running task (reindex, update_by_query, delete_by_query) for progress and errors.

Cancel a running task by id. Use for a runaway reindex or a search eating the cluster.

Delete documents matching a query from an index. DESTRUCTIVE and irreversible. A query is mandatory: match_all is refused so you cannot wipe an index by accident. Runs asynchronously (wait_for_completion=false) and returns a task_id to poll with get_task. Reports how many documents match before deleting. Requires writes enabled, ES_MCP_ALLOW_DESTRUCTIVE=true, and confirm=true.

Update dynamic index settings such as number_of_replicas, refresh_interval, max_result_window, or blocks.*. Static settings (e.g. number_of_shards) cannot be changed on a live index and are refused. Requires writes enabled, ES_MCP_ALLOW_DESTRUCTIVE=true, and confirm=true.

Update documents in place by query, using a painless script. DESTRUCTIVE and irreversible. A query is mandatory: match_all is refused so you cannot rewrite a whole index by accident. Runs asynchronously; returns a task_id to poll with get_task. Reports how many documents match before updating. Requires writes enabled, ES_MCP_ALLOW_DESTRUCTIVE=true, and confirm=true.

Add or remove index aliases atomically in one request. Pass actions as a JSON array, e.g. [{"add": {"index": "logs-2026", "alias": "logs"}}, {"remove": {"index": "logs-2025", "alias": "logs"}}]. Use this to swap an alias from an old index to a new one with zero downtime after a reindex. Only add/remove are allowed. Every index touched is checked against the write policy. Requires writes enabled and confirm=true.

Run an Elasticsearch SQL query via the _sql API. Good for quick aggregate/filter questions without hand-writing Query DSL, e.g. SELECT status, COUNT() FROM "logs-" WHERE code >= 500 GROUP BY status. Only SELECT is allowed. The index in FROM is checked against the allow/deny policy. Row count is capped by fetch_size (server result-size limit applies). Returns columns and rows; if there are more rows a cursor is returned to pass back as the cursor argument.

Translate an Elasticsearch SQL SELECT into the equivalent native Query DSL via _sql/translate, without running it. Use this to learn the DSL for a query, then hand the DSL to run_query for full control (search_after, routing, profiling).

Index (create or overwrite) a single document into an index. Pass doc as a JSON object. Optional doc_id: given, it overwrites that id; omitted, ES assigns one. Set refresh=true to make it searchable immediately (slower). Requires writes enabled and confirm=true.

Bulk index many documents into one index in a single request. Pass documents as a JSON array of objects; each becomes an index action. Optional id_field names a field to use as the document id. Reports how many succeeded and the first few errors. Much faster than index_document in a loop. Requires writes enabled and confirm=true.

Cluster name, version, distribution, and the safety policy this server is running under.