Elasticsearch

You can run an MCP server that lets large language models interact with Elasticsearch clusters through a standardized protocol. This server exposes a comprehensive set of Elasticsearch operations, including CRUD on documents and indices, bulk actions, query-based updates and deletes, cluster health checks, template management, and advanced search with highlighting.

How to use

Connect your MCP client to the Elasticsearch MCP Server using the stdio config that runs locally, or use a remote MCP endpoint if you have one. Once connected, you can invoke tools to list indices, get mappings, perform searches with DSL queries, manage documents (add, update, delete), execute bulk operations, and run by-query updates or deletions. You can also create and delete indices, count documents, fetch templates and aliases, and retrieve cluster health and shard information. Build your queries with full control over size, from, sort, and highlighting to surface the exact results you need.

How to install

Prerequisites: Node.js and npm must be installed on your system. You may also need npx if you choose to run the MCP server directly without a local build.

# Install the MCP server package globally
npm install -g @octodet/elasticsearch-mcp

# Run it directly with npx (no local build required)
npx @octodet/elasticsearch-mcp

# Alternative: clone the source and run from the repository
# (Replace <repository-url> with the actual URL)
git clone <repository-url>
cd elasticsearch-mcp
npm install
npm run build

# Start from the built output if a start script is provided
# (Adjust as needed for your setup)
npm run start

Configuration and usage notes

Environment variables control how the server connects to Elasticsearch. You can set these when starting the server via your MCP client configuration or locally in your environment. The important variables are:

• ES_URL: Elasticsearch server URL (default http://localhost:9200)
• ES_API_KEY: API key for authentication (if used)
• ES_USERNAME: Username for authentication
• ES_PASSWORD: Password for authentication
• ES_CA_CERT: Path to a custom CA certificate
• ES_VERSION: Elasticsearch version (8 or 9)
• ES_SSL_SKIP_VERIFY: Skip SSL verification (true/false)
• ES_PATH_PREFIX: Path prefix for Elasticsearch requests

Available tools

list_indices

List all Elasticsearch indices with optional filtering by a pattern

get_mappings

Retrieve field mappings for a specific index

search

Run a search with a DSL query, with optional highlighting of results

get_cluster_health

Fetch health information for the Elasticsearch cluster

get_shards

Obtain shard information for indices, or all if none specified

add_document

Add a new document to an index, optionally specifying an ID

update_document

Update fields of an existing document by ID

delete_document

Delete a document by ID from an index

update_by_query

Update documents that match a query using a script

delete_by_query

Delete documents that match a query

bulk_operations

Execute multiple document operations in a single request for performance

create_index

Create a new index with optional settings and mappings

delete_index

Delete an index permanently

count_documents

Count documents in an index with an optional filter query

get_templates

Retrieve index templates from Elasticsearch

get_aliases

Retrieve index aliases from Elasticsearch