How to check Elasticsearch cluster stats

Checking Elasticsearch cluster stats provides a quick inventory of node counts, versions, and storage growth for capacity planning and upgrade readiness.

The _cluster/stats API aggregates metrics across the cluster and returns a single JSON payload that summarizes indices, shard distribution, and node characteristics such as roles, OS, JVM, and filesystem usage. The filter_path query parameter trims the response to only the fields needed for quick checks and monitoring dashboards.

The endpoint requires the monitor cluster privilege when security is enabled, and the payload can reveal operational details such as versions and installed plugins. Prefer filter_path for routine checks, avoid polling full stats too frequently on large clusters, and restrict access to the API endpoint on production networks.

1. Request a concise cluster stats summary using filter_path for the most common capacity signals.

   $ curl --silent --show-error --fail "http://localhost:9200/_cluster/stats?filter_path=cluster_name,status,nodes.count.total,nodes.versions,indices.count,indices.store.size_in_bytes&pretty"
   {
     "cluster_name" : "search-cluster",
     "status" : "green",
     "indices" : {
       "count" : 3,
       "store" : {
         "size_in_bytes" : 10864
       }
     },
     "nodes" : {
       "count" : {
         "total" : 1
       },
       "versions" : [
         "8.12.2"
       ]
     }
   }

   On secured clusters, switch the URL to https:// and add authentication (--user, an ApiKey header, or similar) plus TLS trust (--cacert) as required, and consider timeout=5s to avoid waiting indefinitely on an unresponsive node.

   A red status indicates unassigned primary shards and can cause search or indexing failures for affected indices.

2. Request the same summary in a human-readable format for quick reviews.

   $ curl --silent --show-error --fail "http://localhost:9200/_cluster/stats?human=true&filter_path=cluster_name,status,indices.count,indices.store.size&pretty"
   {
     "cluster_name" : "search-cluster",
     "status" : "green",
     "indices" : {
       "count" : 3,
       "store" : {
         "size" : "10.6kb"
       }
     }
   }

3. Capture the full cluster stats payload to a file for deeper offline analysis.

   $ curl --silent --show-error --fail "http://localhost:9200/_cluster/stats?pretty" --output cluster-stats.json

   Full stats can be large on busy clusters and may include version and plugin details.

4. Verify the saved file contains the expected top-level keys.

   $ head -n 25 cluster-stats.json
   {
     "_nodes" : {
       "total" : 1,
       "successful" : 1,
       "failed" : 0
     },
     "cluster_name" : "search-cluster",
     "cluster_uuid" : "tpq9USqHRViOeqiA2eXWxQ",
     "timestamp" : 1767698093833,
     "status" : "green",
     "indices" : {
       "count" : 3,
   ##### snipped #####
   }

5. Limit returned node information to a specific node filter when troubleshooting a subset of the cluster.

   $ curl --silent --show-error --fail "http://localhost:9200/_cluster/stats/nodes/node-01?filter_path=cluster_name,nodes.count.total,nodes.versions&pretty"
   {
     "cluster_name" : "search-cluster",
     "nodes" : {
       "count" : {
         "total" : 1
       },
       "versions" : [
         "8.12.2"
       ]
     }
   }

   Replace node-01 with a node name, ID, or supported node selector understood by the cluster.