# Elasticsearch — MCP Server

> Search indices, read mappings and run query DSL with an AI agent.

**Source:** https://mcpplaygroundonline.com/mcp-servers/elasticsearch  
**Transport:** stdio  
**Requires auth:** Yes

---

## What it does

The Elasticsearch MCP server wraps the Elasticsearch REST API as a small set of MCP tools. Models can enumerate every index, read the field mappings for any index, run a full Elasticsearch query DSL search (with highlighting, profiling and explain), and inspect shard allocation. It runs as a local stdio process — Node.js or the Docker image — configured with your cluster URL and an API key. The reference implementation is open source at elastic/mcp-server-elasticsearch. Elastic now recommends the newer Agent Builder MCP endpoint (Elastic 9.2.0+ and Elasticsearch Serverless) for new projects; the classic server still works and receives critical security fixes.

## Tools exposed

- list_indices — enumerate all indices in the cluster
- get_mappings — return the field mappings for a specific index
- search — run an Elasticsearch query DSL search with highlighting, profiling and explain
- get_shards — inspect shard allocation for all or specific indices

## Example queries you can run

- "List every index in the cluster and tell me which ones look like application logs."
- "Show me the field mappings for the "products" index and flag any text fields missing a keyword sub-field."
- "Search the "orders" index for documents where status is "failed" in the last 24 hours and summarise the top error messages."
- "Run a match query on the "articles" index for "model context protocol" and return the 5 highest-scoring titles."

## Details

- **Recommended model:** anthropic/claude-sonnet-4.5 — Claude Sonnet 4.5 writes correct Elasticsearch query DSL and reasons over mappings reliably. Use Haiku 4.5 for simple list/search calls to keep costs low.
- **Transport:** stdio
- **Authentication:** Required — Elasticsearch cluster URL plus an API key (or username/password). Use a role scoped to read-only on only the indices the agent needs. Or deploy a sandboxed hosted instance from the MCP Playground catalog.
- **Official source:** [elastic/mcp-server-elasticsearch on GitHub](https://github.com/elastic/mcp-server-elasticsearch)

## Frequently asked questions

### What is the Elasticsearch MCP server?

It is an official open-source MCP server from Elastic that lets AI models query an Elasticsearch cluster through natural language. You give it a cluster URL and API key, and it exposes list_indices, get_mappings, search and get_shards tools to any MCP-compatible AI client.

### Which tools does the Elasticsearch MCP server expose?

Four core tools: list_indices to enumerate indices, get_mappings to read field mappings, search to run a full Elasticsearch query DSL search (with highlighting, profiling and explain), and get_shards to inspect shard allocation.

### Is the classic Elasticsearch MCP server deprecated?

Elastic now recommends its newer Agent Builder MCP endpoint (available in Elastic 9.2.0+ and Elasticsearch Serverless) for new projects. The classic elastic/mcp-server-elasticsearch still works and receives critical security updates, so it remains a solid choice for existing clusters.

### Is it safe to connect a production Elasticsearch cluster?

Create an API key with a role scoped to read-only access on only the indices the agent needs, and never share a superuser key. For exploration, point the agent at a read replica or a staging cluster during setup.

### How do I test an Elasticsearch MCP server in the browser?

Open MCP Agent Studio, connect the running Elasticsearch MCP server (or deploy a hosted sandboxed instance from the catalog), pick a model and start chatting. You can watch every list_indices and search tool call live without any local setup.

---

_Test this server across 40+ models on MCP Playground: https://mcpplaygroundonline.com/mcp-servers/elasticsearch — free, no install._