Run an Elasticsearch search using Query DSL and return the matching hits and aggregations.

Count the documents in an index that match an optional Query DSL query.

Run an ES|QL (Elasticsearch Query Language) query and return the result as column metadata plus row objects. Good for filtering, STATS aggregations, and sorting expressed as a piped query string, e.g. FROM idx | WHERE status == "open" | STATS count = COUNT(*) BY host | SORT count DESC. Requires Elasticsearch 8.11+.

Fetch a single document from an index by its id.

List indices with their health, status, document count, and size (equivalent to _cat/indices). Falls back to the index-level _resolve/index API (names only) when the cluster "monitor" privilege is missing.

Get the field mappings for one or more indices. Falls back to the read-level _field_caps API (field names and types) when the index "view_index_metadata" privilege is missing.

Get the settings for one or more indices.

List index aliases, optionally filtered by name (equivalent to _cat/aliases). Falls back to the index-level _resolve/index API when the cluster "monitor" privilege is missing.

List the cluster's shards with their primary/replica role, state, document count, store size, and hosting node (equivalent to _cat/shards). The docs and store columns come back null without the cluster "monitor" privilege; there is no lower-privilege source for per-shard rows, so a missing privilege surfaces as an error.

Get the health of the cluster, optionally scoped to specific indices.

Get cluster-wide statistics covering indices, nodes, shards, and resource usage.

Get basic cluster information: name, UUID, and Elasticsearch version (the root endpoint).

List the nodes in the cluster with role, heap, CPU, and load information (equivalent to _cat/nodes).

Fetch a Kibana saved object (visualization, lens, dashboard, index-pattern, search, map, tag, ...) by ":" reference. Decodes the JSON-as-string fields Kibana stores inline (visState, searchSourceJSON, ...) and resolves references[] to the titles of the objects they point at. Reads .kibana_analytics and .kibana directly, so the API key needs read access to those indices.