How to check Elasticsearch node stats

Elasticsearch node stats expose resource pressure per node, making it easier to pinpoint hot nodes, queue buildup, and low disk space before they turn into indexing slowdowns or cluster instability.

The Nodes stats API (/_nodes/stats) returns a JSON document keyed by node ID, with sections for JVM memory, thread pools, filesystem usage, and other runtime metrics. A node selector (node name, node ID, or _local) narrows the response, while a metric path plus filter_path trims the payload to only the fields needed.

The full stats payload can be large on multi-node clusters, so prefer metric selection (for example /stats/jvm,thread_pool,fs) plus filter_path for interactive troubleshooting. Many deployments also require HTTPS and authentication to access these endpoints, so adjust the base URL and curl options to match the cluster configuration.

1. List node names to choose a node selector for the stats request.

   $ curl -s "http://localhost:9200/_cat/nodes?v&h=name,ip,node.role,heap.percent,ram.percent,cpu,load_1m"
   name    ip         node.role   heap.percent ram.percent cpu load_1m
   node-01 192.0.2.40 cdfhilmrstw           27          98   1    0.77

   The node selector in the URL can be a node name (node-01), a node ID, or _local.

2. Fetch JVM heap usage plus key thread pool queue metrics for a single node.

   $ curl -s "http://localhost:9200/_nodes/node-01/stats/jvm,thread_pool?filter_path=nodes.*.name,nodes.*.jvm.mem.heap_used_percent,nodes.*.jvm.mem.heap_used_in_bytes,nodes.*.jvm.mem.heap_max_in_bytes,nodes.*.thread_pool.search.queue,nodes.*.thread_pool.search.rejected,nodes.*.thread_pool.write.queue,nodes.*.thread_pool.write.rejected&pretty"
   {
     "nodes" : {
       "-562e87MR5-DrMSv7C07Dw" : {
         "name" : "node-01",
         "jvm" : {
           "mem" : {
             "heap_used_in_bytes" : 145932224,
             "heap_used_percent" : 27,
             "heap_max_in_bytes" : 536870912
           }
         },
         "thread_pool" : {
           "search" : {
             "queue" : 0,
             "rejected" : 0
           },
           "write" : {
             "queue" : 0,
             "rejected" : 0
           }
         }
       }
     }
   }

   Thread pool names vary by version, so indexing-related pools may appear as write, index, or bulk depending on the cluster.

3. Check filesystem capacity and available space for the node.

   $ curl -s "http://localhost:9200/_nodes/node-01/stats/fs?filter_path=nodes.*.name,nodes.*.fs.total.total_in_bytes,nodes.*.fs.total.available_in_bytes,nodes.*.fs.data.*.path,nodes.*.fs.data.*.available_in_bytes&pretty"
   {
     "nodes" : {
       "-562e87MR5-DrMSv7C07Dw" : {
         "name" : "node-01",
         "fs" : {
           "total" : {
             "total_in_bytes" : 1963569909760,
             "available_in_bytes" : 1839045599232
           }
         }
       }
     }
   }

   Low available bytes can trigger shard allocation failures or automatic index write blocks when disk watermarks are exceeded.

4. Compare the same key fields across all nodes to spot outliers.

   $ curl -s "http://localhost:9200/_nodes/stats/jvm,thread_pool,fs?filter_path=nodes.*.name,nodes.*.jvm.mem.heap_used_percent,nodes.*.thread_pool.write.queue,nodes.*.thread_pool.write.rejected,nodes.*.fs.total.available_in_bytes&pretty"
   {
     "nodes" : {
       "-562e87MR5-DrMSv7C07Dw" : {
         "name" : "node-01",
         "jvm" : {
           "mem" : {
             "heap_used_percent" : 27
           }
         },
         "thread_pool" : {
           "write" : {
             "queue" : 0,
             "rejected" : 0
           }
         },
         "fs" : {
           "total" : {
             "available_in_bytes" : 1839045591040
           }
         }
       }
     }
   }

5. Download the full node stats payload only when deeper troubleshooting is required.

   $ curl -s "http://localhost:9200/_nodes/stats?pretty" > nodes-stats.json
   $ wc -c nodes-stats.json
   77793 nodes-stats.json

   Full node stats can be large and may reveal cluster topology details, so avoid sharing the raw JSON outside trusted troubleshooting channels.