elasticsearch

name	Elasticsearch
slug	elasticsearch
version	1.0.2
description	Designs, queries, and operates Elasticsearch: mappings, analyzers, query DSL, aggregations, bulk indexing, shard sizing, and cluster health. Use when writing a search query or an index mapping, when a search returns nothing or the wrong documents, when a term query on a text field returns zero hits without an error, when results rank badly, when aggregations fail with "fielddata is disabled", when the cluster turns yellow or red, when shards stay unassigned, when indexing is slow or a bulk request returns per-item errors, when disk hits the flood-stage watermark and indices go read-only, when circuit breakers trip, or when paging past 10,000 hits breaks. Covers ILM rollover, reindexing, snapshots, upgrades, kNN and hybrid vector search, autocomplete, synonyms and analyzers, nested modeling, geo queries, ES|QL, Painless, ingest pipelines, data streams, security, language clients, and OpenSearch compatibility. Not for standalone vector stores (vector-databases) or lightweight site search (meilisearch).
homepage	https://clawic.com/skills/elasticsearch
changelog	Display name shown correctly
metadata	{"clawdbot":{"emoji":"🔍","requires":{"anyBins":"[Truncated]"},"os":["linux","darwin","win32"],"displayName":"Elasticsearch","configPaths":["~/Clawic/data/elasticsearch/","~/elasticsearch/","~/clawic/elasticsearch/"]},"openclaw":{"requires":{"config":"[Truncated]"}}}

User preferences and memory live in ~/Clawic/data/elasticsearch/ (see setup.md on first use, memory-template.md for the file format). If you have data at an old location (~/elasticsearch/ or ~/clawic/elasticsearch/), move it to ~/Clawic/data/elasticsearch/, and say in one line that you moved it and from where.

When To Use

• Writing or reviewing a query DSL body, an index mapping, an analyzer, or an aggregation
• Search is wrong: no hits, wrong documents, wrong order, wrong buckets, or duplicates
• The cluster is unhealthy: yellow or red, unassigned shards, read-only indices, breakers tripping, heap pressure
• Indexing or search is slow, or bulk requests fail, stall, or get rejected
• Designing the index layout: shard counts, aliases, templates, data streams, ILM, multi-tenancy, reindex plans
• Operating it: snapshots and restores, security and API keys, monitoring, rolling upgrades, migration to or from OpenSearch
• Not for choosing a standalone vector database, or for lightweight site search where a cluster is more than the job needs (see Related Skills)

Quick Reference

Situation	Play
Zero hits, no error, and you can see the value in _source	A term query against a text field, or case mismatch on a keyword — run _analyze and compare tokens (→ debugging.md)
Right documents, wrong order	Get "explain": true on one bad document before touching a single boost (→ relevance.md)
"Fielddata is disabled on text fields by default"	Aggregate and sort on the .keyword sub-field, never enable fielddata (Core Rules 9)
Need full-text search AND exact match on one field	Multi-field: text with a fields.keyword sub-field (→ mapping.md)
Need to change a field's type, analyzer, or index setting	Impossible in place: new index → _reindex → alias swap (Core Rules 3 → index-lifecycle.md)