How to Query Elasticsearch Without Kibana

Updated July 2026 · Works with Elasticsearch 6.x–9.x

Kibana is the default answer for talking to Elasticsearch, but plenty of clusters run without it: a production cluster where only Elasticsearch is exposed, a staging box someone set up years ago, a local Docker container you spun up for one test. The good news — Elasticsearch is just an HTTP API. Here are three practical ways to query it directly, from quickest to most comfortable.

Option 1: curl with Query DSL

Everything Kibana's Dev Tools does is a plain HTTP request underneath. A full-text search against an index called products:

curl -s -X POST "http://localhost:9200/products/_search?pretty" \
  -H "Content-Type: application/json" \
  -d '{
    "query": {
      "match": { "name": "wireless headphones" }
    },
    "size": 10
  }'

Three details that trip people up:

• The Content-Type header is required. Without it Elasticsearch returns 406 Content-Type header is missing.
• Authentication. Secured clusters need -u user:password (basic auth) or an Authorization: ApiKey … / Authorization: Bearer … header.
• Self-signed TLS. Elasticsearch 8+ ships with HTTPS on by default; for a local cluster with a self-signed certificate add -k (or better, pass the CA with --cacert).

A few requests you'll reach for constantly:

# What indices exist, sorted by size
curl -s "http://localhost:9200/_cat/indices?v&s=store.size:desc"

# Cluster health
curl -s "http://localhost:9200/_cluster/health?pretty"

# The last 5 documents that match a filter
curl -s -X POST "http://localhost:9200/logs-*/_search?pretty" \
  -H "Content-Type: application/json" \
  -d '{
    "query": { "term": { "level": "error" } },
    "sort": [{ "@timestamp": "desc" }],
    "size": 5
  }'

Option 2: URI search for quick checks

For a fast "is my data there?" check you can skip the request body entirely and put a Lucene query string in the URL:

curl -s "http://localhost:9200/products/_search?q=name:headphones&size=5&pretty"

URI search supports field names (q=status:active), booleans (q=status:active+AND+price:[100+TO+200]), and wildcards. It's great for one-liners and terrible for anything complex — quoting, URL-encoding, and operator precedence get painful quickly. When a query needs more than one condition, switch back to a JSON body.

Option 3: a GUI in your browser

curl works, but writing Query DSL by hand in a terminal has real friction: no autocomplete, no formatting, mistyped field names silently return zero hits, and long JSON responses are hard to scan.

A browser-based Elasticsearch GUI fixes that without installing a server or desktop app. Elasticvix is a free, open-source (MIT) Chrome extension that connects straight from your browser to any cluster you can reach — nothing is sent anywhere else. What it adds over the terminal:

• Autocomplete that reads your cluster — it suggests your real field names from the index mapping, and even real values of keyword fields, not just static Query DSL keywords.
• Field linting — a field that doesn't exist in the mapping gets flagged before you run, which kills the classic silent-zero-hits bug.
• A response viewer built for big JSON — fold nodes, filter to the paths you care about, download the result.
• Saved queries and history, so the query you crafted last Tuesday is still there.

Which one should you use?

• One-off check from a server you're SSH'd into: curl or URI search.
• Scripting and automation: curl (or a client library in your language).
• Daily exploration, debugging, and query writing: a GUI — the autocomplete and readable responses pay for themselves within the first session.