How to Use Elasticsearch MCP with Claude Code

What is the Elasticsearch MCP?

The Elasticsearch MCP connects Claude Code to your Elasticsearch or OpenSearch cluster. It enables Claude to run queries, manage indices and mappings, execute aggregations for analytics, and debug search relevance — making it a powerful companion for log analysis, full-text search, and observability pipelines.

Installation

mcpizy install elasticsearch

Provide your Elasticsearch host URL, and credentials (API key or username/password) during setup. Cloud deployments on Elastic Cloud are fully supported.

Key Capabilities

• Execute search queries — run match, term, range, and bool queries with full DSL support.
• Run aggregations — compute bucket, metric, and pipeline aggregations for analytics.
• Manage indices — create, delete, and update index settings and mappings.
• Inspect cluster health — check shard allocation, node status, and cluster state.
• Debug relevance — use _explain to understand why a document scored the way it did.

Example Usage

Analyze error log patterns from the last hour:

{
  "query": { "range": { "@timestamp": { "gte": "now-1h" } } },
  "aggs": {
    "errors_by_service": {
      "terms": { "field": "service.name", "size": 10 }
    }
  }
}

Claude runs this against your logs index and summarizes which services are generating the most errors.

Tips and Best Practices

• Use API keys with minimum required privileges — separate keys for read-only search vs. index management.
• Ask Claude to use _explain when a document isn't ranking where you expect it — it reveals the scoring breakdown.
• Combine with Grafana MCP to correlate Elasticsearch log data with time-series metrics.
• For simpler full-text search needs, consider the Meilisearch MCP — it is easier to operate and tune.

View on MCPizy Marketplace