Manage an Alibaba Cloud Elasticsearch cluster via CLI - Elasticsearch

This topic shows you how to connect to an Alibaba Cloud Elasticsearch cluster from the command line by using curl.

Before you begin

Obtain the cluster endpoint

You can connect to your Elasticsearch cluster by using an internal endpoint over a VPC private network or a public endpoint.

Internal endpoint: Provides a low-latency, high-stability connection to your Elasticsearch cluster. This endpoint is enabled by default upon cluster creation.
Public endpoint: Allows you to connect to your Elasticsearch cluster over the internet. You must enable this endpoint manually.

Enable public access

Log on to the Elasticsearch console and navigate to the Basic Information page of your instance.
In the navigation pane, choose Configuration and Management > Security Settings and enable public access. Public access is enabled once the cluster status changes from Initializing to Valid.

After you enable public access, the public endpoint is in the format es-cn-<instance_ID>.public.elasticsearch.aliyuncs.com. The public IP whitelist is empty by default and must be configured.

Important
Using a public endpoint can compromise the security of your Elasticsearch cluster. If you use a public endpoint, be sure to configure an IP whitelist and disable public access when you are done.

Configure an IP whitelist

To secure your cluster, you must add the IP address of the device you want to use for access to the VPC private network or public IP whitelist of the Elasticsearch cluster. Only devices with IP addresses in the whitelist can access the cluster.

Obtain the IP address of the device you want to use for access.

The following table explains how to obtain the IP address for different scenarios.

Scenario	IP address	Method
Connect to an Elasticsearch cluster from a local device	The public IP address of your local device. If your local device is on a local area network (LAN), such as a home or corporate network, you must add the public IP address of the LAN's gateway to the cluster's public IP whitelist.	Run the `curl ipinfo.io/ip` command to find the public IP of your local device.
Connect to an Elasticsearch cluster from an ECS instance in a different VPC	The public IP of the ECS instance.	Log on to the ECS console to view it in the instance list.
Connect to an Elasticsearch cluster from an ECS instance in the same VPC	The private IP of the ECS instance.	Log on to the ECS console to view it in the instance list.

Add this IP address to a whitelist group.

Log on to the Elasticsearch console. On the Basic Information page of your instance, choose Configuration and Management > Security Settings in the navigation pane. Click Modify to configure the VPC private network or public IP whitelist.

Click Configure to the right of the default group. In the dialog box that appears, add IP addresses to the VPC private network or public IP whitelist. You can add up to 300 IP addresses or CIDR blocks to a cluster. Separate multiple entries with a comma (,) and do not add spaces around it.

You can also click Add IP address whitelist Group to create a custom group.
Whitelist groups are for IP address management only and do not affect access permissions. All IP addresses across all groups have the same permissions.

Configuration type

Format and example

Important notes

IPv4 address format

Single IP: 192.168.0.1
CIDR block: 192.168.0.0/24

Deny all access: 127.0.0.1
Allow all access: 0.0.0.0/0

Important
This poses a high security risk. We strongly recommend that you do not configure 0.0.0.0/0.

Some cluster versions (such as 7.16 and 8.5) and regions do not support 0.0.0.0/0. Refer to the console UI or error messages for details.

IPv6 address format

(Supported only for v2 deployment architecture clusters in the China (Hangzhou) region)

Single IP: 2401:XXXX:1000:24::5
CIDR block: 2401:XXXX:1000::/48

Deny all access: ::1
Allow all access: ::/0

Important
This poses a high security risk. We strongly recommend that you do not configure ::/0.

Some cluster versions do not support ::/0. Refer to the console UI or configuration prompts for details.

Click OK.

Protocols and certificates

Public HTTPS: Uses a certificate issued by a trusted certificate authority (CA). No special client configuration is needed. Connect directly by using the https:// protocol.
Private HTTPS: Uses a self-signed certificate for encrypted transmission. Because a VPC private network is secure from man-in-the-middle attacks, you can safely access the cluster by using the -k parameter to bypass certificate validation.

Connect to the cluster

Command syntax

# Public HTTPS
curl -u '<UserName>:<YourPassword>' 'https://<YourEsHost>:port'

# Private HTTP
curl -u '<UserName>:<YourPassword>' 'http://<YourEsHost>:port'

# Private HTTPS (use -k to bypass certificate validation)
curl -k -u '<UserName>:<YourPassword>' 'https://<YourEsHost>:port'

Parameter	Description
UserName	The default username, elastic, is the administrator account with the highest permissions on the cluster. For security reasons, we recommend that you do not use this default administrator account in a production environment. You can use the Role-Based Access Control (RBAC) mechanism of Elasticsearch X-Pack to create custom roles, assign permissions, and then assign roles to users for fine-grained access control. For more information, see Manage user permissions with Elasticsearch X-Pack roles.
YourPassword	The password for the specified UserName.
https	The access protocol. The HTTP protocol is enabled by default. We recommend that you enable and use the HTTPS protocol to ensure the confidentiality, security, and integrity of data in transit. To enable HTTPS, log on to the Elasticsearch console. On the Basic Information page of your instance, choose Configuration and Management > Security Settings in the navigation pane, and then enable the HTTPS protocol. Important Before enabling the HTTPS protocol, make sure to update your application code to support HTTPS connections. Otherwise, existing code that uses the HTTP protocol will fail to establish a secure connection. Private HTTPS uses a self-signed certificate. You must use the `-k` parameter to bypass certificate validation.
YourEsHost	The cluster endpoint that you obtained in the "Before you begin" section: internal endpoint public endpoint
port	The port for accessing the cluster. The default port is 9200 for both VPC private network and public access.

Examples

# Public HTTPS access
curl -u 'user123:Passw0rd!' 'https://es-xx-xxxxxxxxxxxxxxxxx.public.elasticsearch.aliyuncs.com:9200'

# Private HTTP access
curl -u 'user123:Passw0rd!' 'http://es-cn-0pp1****.elasticsearch.aliyuncs.com:9200'

# Private HTTPS access (-k to bypass certificate validation)
curl -k -u 'user123:Passw0rd!' 'https://es-cn-0pp1****.elasticsearch.aliyuncs.com:9200'

A successful connection returns the following cluster information. You can then use the Elasticsearch REST APIs to manage your cluster or perform indexing operations.

{
  "name" : "es-cn-aic**************-master-i-2",
  "cluster_name" : "es-cn-aic**************",
  "cluster_uuid" : "InmpfI1oQB2ijtdZ******",
  "version" : {
    "number" : "8.17.0",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "0bdf7********************************50279ae7c",
    "build_date" : "2025-03-05T02:31:55.853663566Z",
    "build_snapshot" : false,
    "lucene_version" : "10.0.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}