Elasticsearch cmds

Query for 1 record in an index

curl -u user:password \
  -X GET "https://es.contoso.com/filebeat-2026.04.18/_search" \
  -H "Content-Type: application/json" \
  -d '{
    "size": 1,
    "sort": [{ "@timestamp": "desc" }],
    "query": { "match_all": {} }
  }'

Create an index template which can be used to attach index lifecycle policies.

curl -u user:password \
  -X PUT "https://es.contoso.com/_index_template/recon-template" \
  -H "Content-Type: application/json" \
  -d '{
    "index_patterns": ["recon-*"],
    "template": {
      "settings": {
        "number_of_shards": 1,
        "number_of_replicas": 1
      }
    }
  }'

Create a document.

curl -u user:password \
  -X POST "https://es.contoso.com/recon-2026.04.12/_doc" \
  -H "Content-Type: application/json" \
  -d '{
    "@timestamp": "2026-04-12T12:20:00Z",
    "message": "first recon log",
    "level": "info",
    "service": "recon-api"
  }'

Delete an index

curl -u user:password \
  -X DELETE "https://es.contoso.com/recon"

Authenticating with an API key

API_KEY="hdsbchdbvh=="

curl -H "Authorization: ApiKey $API_KEY" \
  -X GET "https://es.contoso.com/finflow-2026.04.*/_search" \
  -H "Content-Type: application/json" \
  -d '{
    "size": 1,
    "sort": [{ "@timestamp": "desc" }],
    "query": { "match_all": {} }
  }'

Getting API key permissions

GET /_security/api_key?name=recon&with_limited_by=true

Updating API key permissions

curl -u user:password \
  -X POST "https://staging-elastic.pub.credrails.com/_security/api_key/_bulk_update" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": ["hbcsdjbcjh"],
    "role_descriptors": {
      "recon": {
        "cluster": [],
        "indices": [
          { "names": ["recon-*"], "privileges": ["create_index", "create", "write", "create_doc", "index", "read"] },
          { "names": ["finflow-*"], "privileges": ["create_index", "create", "write", "create_doc", "index", "read"] }
        ]
      }
    }
  }'