How to check Elasticsearch cluster stats

Checking Elasticsearch cluster stats gives a cluster-wide view of index growth, node versions, and shard footprint without walking through multiple node or cat APIs. That snapshot is useful for capacity planning, pre-upgrade checks, and confirming the cluster still matches operational expectations.

The _cluster/stats API aggregates index and node metadata into one JSON response, while node filters such as _local or explicit node names limit the scope to selected members. The filter_path parameter trims the payload to the fields needed for a quick check, and human=true converts byte counters into readable sizes for manual reviews.

Access requires the monitor cluster privilege when security is enabled, and many production deployments also require HTTPS, authentication, and trusted CA material. The full payload can expose cluster topology, versions, JVM, filesystem, and plugin details, so use filtered requests for routine checks, add timeout on slow clusters, and collect the full JSON only when a deeper review is needed.

1. Request a concise cluster stats summary using filter_path for the most common capacity signals.

   $ curl -sS --fail "http://localhost:9200/_cluster/stats?filter_path=cluster_name,status,nodes.count.total,nodes.versions,indices.count,indices.docs.count,indices.store.size_in_bytes&pretty"
   {
     "cluster_name" : "docker-cluster",
     "status" : "yellow",
     "indices" : {
       "count" : 2,
       "docs" : {
         "count" : 2
       },
       "store" : {
         "size_in_bytes" : 10814
       }
     },
     "nodes" : {
       "count" : {
         "total" : 1
       },
       "versions" : [
         "9.3.1"
       ]
     }
   }

   A single-node cluster often reports yellow when indices still have one replica configured; that clears after another data node joins or replicas are reduced to zero.

   On secured clusters, use the cluster HTTPS endpoint and the authentication method already used by operators for that cluster.

2. Request the same summary in a human-readable format for quick reviews.

   $ curl -sS --fail "http://localhost:9200/_cluster/stats?human=true&filter_path=cluster_name,status,indices.count,indices.docs.count,indices.store.size&pretty"
   {
     "cluster_name" : "docker-cluster",
     "status" : "yellow",
     "indices" : {
       "count" : 2,
       "docs" : {
         "count" : 2
       },
       "store" : {
         "size" : "10.5kb"
       }
     }
   }

   Use the byte-based fields for scripts and alerts, and the human=true view for quick operator reviews.

3. Capture the full cluster stats payload to a file for deeper offline analysis.

   $ curl -sS --fail "http://localhost:9200/_cluster/stats?pretty" > cluster-stats.json

   Full cluster stats can be large and may reveal versions, plugins, and topology details. Add include_remotes=true when the snapshot should include configured remote clusters.

4. Verify the saved file contains the expected top-level keys.

   $ head -n 25 cluster-stats.json
   {
     "_nodes" : {
       "total" : 1,
       "successful" : 1,
       "failed" : 0
     },
     "cluster_name" : "docker-cluster",
     "cluster_uuid" : "hmf-B631To-A1L6mJC2crQ",
     "timestamp" : 1775108015951,
     "status" : "yellow",
     "indices" : {
       "count" : 2,
   ##### snipped #####
   }

   Review _nodes.failed before treating the file as a complete cluster-wide snapshot.

5. Limit returned cluster stats to the local node view when troubleshooting from a specific host.

   $ curl -sS --fail "http://localhost:9200/_cluster/stats/nodes/_local?filter_path=cluster_name,_nodes,nodes.count.total,nodes.versions&pretty"
   {
     "_nodes" : {
       "total" : 1,
       "successful" : 1,
       "failed" : 0
     },
     "cluster_name" : "docker-cluster",
     "nodes" : {
       "count" : {
         "total" : 1
       },
       "versions" : [
         "9.3.1"
       ]
     }
   }

   Replace _local with a node name, node ID, or a comma-separated node filter list when narrowing the response to specific members.

6. Add a per-node timeout when a slow or unreachable node should not stall the stats request.

   $ curl -sS --fail "http://localhost:9200/_cluster/stats?timeout=5s&filter_path=_nodes,cluster_name,status&pretty"
   {
     "_nodes" : {
       "total" : 1,
       "successful" : 1,
       "failed" : 0
     },
     "cluster_name" : "docker-cluster",
     "status" : "yellow"
   }

   Timed-out nodes are counted under _nodes.failed. Retry against a healthy coordinator or investigate node connectivity before trusting a partial result.