How to identify the elected master node in Elasticsearch

Identifying the elected master node is one of the fastest ways to confirm whether Elasticsearch cluster coordination is stable during outages, rolling restarts, and shard movement investigations. The elected master publishes cluster-state changes, so a missing or frequently changing master often explains stalled allocation, delayed metadata updates, or repeated node-join noise.

The Elasticsearch coordination subsystem elects the master from the set of master-eligible nodes. The _cat/master endpoint returns the current elected node in a compact table for terminal checks, while _cat/nodes shows whether the same node is marked with * in the master column and includes m in node.role for master eligibility.

Current self-managed Elasticsearch releases enable security automatically on first start, so API checks commonly require HTTPS, credentials, and the generated HTTP CA certificate. The cluster-state API can also confirm the elected node ID, but Elastic documents it as a diagnostic interface rather than a polling endpoint, so the request should stay narrowly filtered and be used only as an occasional cross-check.

1. Query the elected master node directly.

   $ curl --silent --show-error \ \
     --user elastic:your-password \
     "https://localhost:9200/_cat/master?v"
   id                     host       ip         node
   JndZsMgTSmukbYqEPosNHg  192.0.2.40 192.0.2.40 es-master-01

   The request needs the monitor cluster privilege. If security is disabled in that environment, drop the CA and authentication flags and query the cluster's configured endpoint instead.

   A 401 or 403 response indicates missing credentials or insufficient privilege, while 503 or master_not_discovered_exception indicates the cluster does not currently have an elected master.

2. Cross-check the same node against the cluster node list.

   $ curl --silent --show-error \ \
     --user elastic:your-password \
     "https://localhost:9200/_cat/nodes?v&full_id=true&h=id,name,ip,node.role,master"
   id                     name         ip         node.role   master
   JndZsMgTSmukbYqEPosNHg  es-master-01 192.0.2.40 cdfhilmrstw *

   The master column shows * on the elected master. The node.role column includes m on master-eligible nodes and v on voting-only nodes, which can participate in elections without becoming the elected master.

3. Confirm the elected node ID from cluster state when a second check is needed.

   $ curl --silent --show-error \ \
     --user elastic:your-password \
     "https://localhost:9200/_cluster/state/master_node?filter_path=cluster_name,master_node"
   {"cluster_name":"search-cluster","master_node":"JndZsMgTSmukbYqEPosNHg"}

   Using filter_path=cluster_name,master_node keeps the diagnostic response narrow. Elastic warns that the cluster-state API can be expensive on larger clusters, so reserve it for debugging or occasional verification instead of frequent polling.