Core CRUD and Search Endpoints
The everyday Elasticsearch REST surface centers on a handful of verbs against an index path: PUT my-index/_doc/1 to index a document with an explicit ID, POST my-index/_doc to auto-generate one, GET my-index/_doc/1 to retrieve it, and DELETE my-index/_doc/1 to remove it. Bulk operations use the _bulk endpoint with newline-delimited JSON action/metadata and source lines, which is dramatically faster than issuing many single-document requests because it amortizes network round trips and internal refresh overhead across a batch. Search itself goes through GET my-index/_search with a JSON body containing a query, and the _count endpoint offers a lighter-weight way to get just a match total without fetching document bodies.
Cricket analogy: This is like a scorer's quick-reference card: 'W' logs a wicket, 'no-ball' flags an infraction, 'declare' ends an innings — a small fixed vocabulary of commands that covers almost every in-match action, just like Elasticsearch's core CRUD verbs.
Query DSL Cheat Sheet
For full-text relevance search, match is the workhorse for a single analyzed field, multi_match extends that across several fields with optional boosting like "title^3", and match_phrase enforces term order. For exact-value filtering, term matches a keyword field precisely, terms matches against a list of values, and range handles numeric or date bounds with gte/lte. These combine inside a bool query's must (scored, AND semantics), should (scored, OR semantics, useful with minimum_should_match), must_not (excluding, unscored), and filter (non-scoring, cacheable) clauses to build arbitrarily complex conditions.
Cricket analogy: This is like a captain's field-setting toolkit: attacking fields (must, aggressive and scored for wickets), defensive fields (filter, just stopping runs without style points), and a mix used together to build the full strategy for an over.
Cluster and Index Admin Commands
GET _cluster/health gives an at-a-glance status (green/yellow/red) plus shard counts, and is usually the first command run when diagnosing an issue. GET _cat/indices?v lists indices with document counts and sizes in a human-readable table, while GET _cat/nodes?v shows node roles and resource usage. For index management, PUT my-index/_settings updates dynamic settings like number_of_replicas without downtime, POST my-index/_forcemerge can reduce segment count on read-only indices to improve query speed, and GET my-index/_mapping shows the current field mappings for quick inspection.
Cricket analogy: GET _cluster/health is like glancing at the main scoreboard for the overall match state (green: all's well, yellow: a wicket down, red: in serious trouble) before diving into ball-by-ball details.
# Cluster health at a glance
GET _cluster/health
# List indices with sizes
GET _cat/indices?v&s=store.size:desc
# Bulk index example
POST _bulk
{ "index": { "_index": "products", "_id": "1" } }
{ "name": "Wireless Mouse", "price": 25.99 }
{ "index": { "_index": "products", "_id": "2" } }
{ "name": "Mechanical Keyboard", "price": 89.99 }
# Update replica count without downtime
PUT products/_settings
{ "number_of_replicas": 2 }The _cat API family (_cat/indices, _cat/nodes, _cat/shards, _cat/thread_pool) is designed for quick human-readable terminal output and accepts ?v for column headers and ?h=<columns> to select specific columns, making it ideal for fast diagnostics.
_bulk requests are newline-delimited JSON, not a JSON array, and every line, including the final one, must end with a newline character. A malformed bulk body is a common source of confusing 'illegal_argument_exception' errors.
- Core CRUD uses PUT/POST/GET/DELETE against my-index/_doc/{id}; _bulk batches many operations efficiently.
- match, multi_match, and match_phrase drive full-text relevance search on text fields.
- term, terms, and range provide exact-value filtering, typically inside a bool query's filter clause.
- bool query clauses: must and should are scored, must_not and filter are not.
- GET _cluster/health and the _cat API family give fast, human-readable cluster diagnostics.
- PUT _settings can change dynamic settings like number_of_replicas without downtime.
- _bulk request bodies are newline-delimited JSON, and every line must end with a newline.
Practice what you learned
1. Which endpoint is used to index many documents efficiently in a single request?
2. Which query type enforces that matched terms appear in the same order as the search phrase?
3. Within a bool query, which clauses contribute to the relevance _score?
4. What format must the body of a _bulk request use?
Was this page helpful?
You May Also Like
Elasticsearch Interview Questions
Commonly asked Elasticsearch interview topics covering architecture, indexing internals, and querying, with worked explanations.
Elasticsearch with Kibana
How Kibana pairs with Elasticsearch as the visualization, exploration, and management layer of the Elastic Stack.
Elasticsearch Security Basics
Core security features of Elasticsearch: authentication, role-based access control, TLS, and audit logging.