Elastic Search: how to see the indexed data

Solution 1:

Probably the easiest way to explore your ElasticSearch cluster is to use elasticsearch-head.

You can install it by doing:

cd elasticsearch/
./bin/plugin -install mobz/elasticsearch-head

Then (assuming ElasticSearch is already running on your local machine), open a browser window to:

http://localhost:9200/_plugin/head/

Alternatively, you can just use curl from the command line, eg:

Check the mapping for an index:

curl -XGET 'http://127.0.0.1:9200/my_index/_mapping?pretty=1' 

Get some sample docs:

curl -XGET 'http://127.0.0.1:9200/my_index/_search?pretty=1' 

See the actual terms stored in a particular field (ie how that field has been analyzed):

curl -XGET 'http://127.0.0.1:9200/my_index/_search?pretty=1'  -d '
 {
    "facets" : {
       "my_terms" : {
          "terms" : {
             "size" : 50,
             "field" : "foo"
          }
       }
    }
 }

More available here: http://www.elasticsearch.org/guide

UPDATE : Sense plugin in Marvel

By far the easiest way of writing curl-style commands for Elasticsearch is the Sense plugin in Marvel.

It comes with source highlighting, pretty indenting and autocomplete.

Note: Sense was originally a standalone chrome plugin but is now part of the Marvel project.

Solution 2:

Absolutely the easiest way to see your indexed data is to view it in your browser. No downloads or installation needed.

I'm going to assume your elasticsearch host is http://127.0.0.1:9200.

Step 1

Navigate to http://127.0.0.1:9200/_cat/indices?v to list your indices. You'll see something like this:

Step 2

Try accessing the desired index: http://127.0.0.1:9200/products_development_20160517164519304

The output will look something like this:

Notice the aliases, meaning we can as well access the index at: http://127.0.0.1:9200/products_development

Step 3

Navigate to http://127.0.0.1:9200/products_development/_search?pretty to see your data:

Solution 3:

ElasticSearch data browser

Search, charts, one-click setup....

Solution 4:

Aggregation Solution

Solving the problem by grouping the data - DrTech's answer used facets in managing this but, will be deprecated according to Elasticsearch 1.0 reference.

Warning

Facets are deprecated and will be removed in a future release. You are encouraged to
migrate to aggregations instead.

Facets are replaced by aggregates - Introduced in an accessible manner in the Elasticsearch Guide - which loads an example into sense..

Short Solution

The solution is the same except aggregations require aggs instead of facets and with a count of 0 which sets limit to max integer - the example code requires the Marvel Plugin

# Basic aggregation
GET /houses/occupier/_search?search_type=count
{
    "aggs" : {
        "indexed_occupier_names" : {    <= Whatever you want this to be
            "terms" : {
              "field" : "first_name",    <= Name of the field you want to aggregate
              "size" : 0
            }
        }
    }
}

Full Solution

Here is the Sense code to test it out - example of a houses index, with an occupier type, and a field first_name:

DELETE /houses

# Index example docs
POST /houses/occupier/_bulk
{ "index": {}}
{ "first_name": "john" }
{ "index": {}}
{ "first_name": "john" }
{ "index": {}}
{ "first_name": "mark" }


# Basic aggregation
GET /houses/occupier/_search?search_type=count
{
    "aggs" : {
        "indexed_occupier_names" : {
            "terms" : {
              "field" : "first_name",
              "size" : 0
            }
        }
    }
}

Response

Response showing the relevant aggregation code. With two keys in the index, John and Mark.

    ....
    "aggregations": {
      "indexed_occupier_names": {
         "buckets": [
            {
               "key": "john",     
               "doc_count": 2     <= 2 documents matching
            },                        
            {
               "key": "mark",
               "doc_count": 1     <= 1 document matching
            }
         ]
      }
   }
   ....