Free & open source · Apache-2.0 · v6.124.1

Elasticdump – Export and Import Data Easily

Elasticdump is the small command-line tool most people reach for when an index needs to be somewhere else: another cluster, a JSON file, an S3 bucket. This site is the plain-English manual for it, covering where to download it, how to install it, how to log in to a secured cluster, and what to do when it breaks.

$ npm install elasticdump -g

≈7.9k stars

on GitHub

10M+ pulls

on Docker Hub

Apache-2.0

free for any use

ES + OpenSearch

both supported

What it is

What is Elasticdump, in plain words?

Think of Elasticdump as cp for Elasticsearch. You tell it where the data lives (--input) and where it should go (--output), and it does the tedious part: paging through the index, batching documents and writing them out on the other side.

It doesn’t need plugins, a snapshot repository or access to the cluster’s disks, just an HTTP connection. That is why it is so popular for quick jobs: refreshing staging with production data, keeping a readable backup before an upgrade, or handing a colleague a slice of an index as a file.

Who it's for

Elasticdump.com is an independent site. It isn’t run by the elasticsearch-dump maintainers, Elastic N.V. or the OpenSearch project.
One input, one output, lots of combinations.

Features

What Elasticdump can do

Nine things it handles well. Every one is documented in the official README, so none of this is guesswork.

Elasticsearch and OpenSearch

Talks to Elasticsearch and, since v6.76.0, OpenSearch. AWS OpenSearch Serverless works too (v6.110.1+).

More than documents

Mappings, analyzers, settings, aliases, templates and ILM policies all move with the same command. Just change --type.

Files, stdout and gzip

Write line-delimited JSON, pipe through stdout, gzip on the fly with --fsCompress, or split huge dumps with --fileSize.

Straight to S3 or MinIO

Use an s3:// URL as input or output. MinIO and other S3-compatible stores work with --s3Endpoint.

CSV in and out

The csv:// prefix (v6.42.0+) imports spreadsheets into an index, or exports documents for people who live in Excel.

Export only what you need

--searchBody takes any Query DSL, from a single term to a date range. Keep long queries in a file with @query.json.

Edit documents on the way

--transform runs JavaScript on every document, for example to rename a field or mask emails before sharing a dump.

Many indices at once

multielasticdump ships in the same package and works through dozens of indices in parallel, one fork per CPU by default.

Works with secured clusters

Basic auth, API keys via headers, your own CA certificate, client certificates and AWS request signing are all supported.

How it works

Three parts to every command

Once this clicks, every Elasticdump command reads like a sentence: take this, maybe change it, put it there.

01

Input

Where the data comes from: a cluster URL like http://127.0.0.1:9200/my_index, a dump file, an s3:// or csv:// path, or $ for stdin.

02

Process

Elasticdump pulls documents in batches (100 by default), runs your –transform if you set one, and keeps the scroll alive.

03

Output

Where it lands: another cluster, a JSON file, split or gzipped files, S3, CSV, or stdout for piping into other tools.

Under the hood

What actually happens when you press Enter

A simplified view of the read and write loop.

Reading. For a cluster input, Elasticdump opens a scroll search, which holds a consistent view of the results for --scrollTime (10 minutes by default), and fetches about --limit documents per request. On Elasticsearch 7.17+ you can switch to --searchAfter or point-in-time with --pit.

Writing. Cluster outputs get bulk requests. Files get one JSON document per line, which is why you can stream or append them safely.

Order isn’t preserved. Since v6.1.0, batches overlap to go faster, so documents can arrive in a different order. Search doesn’t care; scripts that read the file top to bottom might.

Missing indices are created for you using dynamic mapping. That’s convenient, and also the classic way to end up with the wrong field types. Copy the mapping first.

One line of a dump file (fields vary with cluster version):
{"_index":"orders","_id":"1042","_score":1,"_source":{"customer":"acme","total":129.5,"status":"paid"}}

Download

Elasticdump download: the official sources

There’s no .exe or .dmg to hunt for. Elasticdump ships as an npm package and a Docker image, and the source lives on GitHub. Pick the one that matches how you work; they all run the same code.

Choose how to install

npm install elasticdump -g
docker pull elasticdump/elasticsearch-dump

We never rehost or repackage Elasticdump. If a site offers you an “elasticdump.exe”, close the tab.

Requirements

System requirements

Elasticdump is a Node.js program rather than a desktop app, so it runs anywhere Node.js runs. There’s no separate Windows, Mac or Linux build to pick.

RequirementMinimumRecommended
Node.js10.0.0 (enforced since Elasticdump 6.67.0)A current Node.js LTS release
Package managernpm (bundled with Node.js)npm from your Node.js install
Operating systemAny OS with Node.js: Windows, macOS, LinuxLinux or macOS shell for easier JSON quoting
Alternative runtimeDocker (no Node.js needed)elasticdump/elasticsearch-dump image
Elasticsearch5.x+ for default queries (since Elasticdump 3.0.0)A supported, current release
OpenSearchSupported from Elasticdump 6.76.0Recent Elasticdump version
Disk spaceEnough for the dump file(s)Use –fileSize or –fsCompress for big indices

Package size isn’t listed here because npm installs Elasticdump together with its dependencies, and the total changes from release to release.

Install

Install Elasticdump in about two minutes

This is the npm route. If you’d rather not install Node.js at all, skip to the Docker command in the download box.

01

Install Node.js

Grab a current LTS release from nodejs.org. Elasticdump refuses to start on anything older than Node.js 10.

02

Install the package

Run npm install elasticdump -g. That adds two commands: elasticdump and multielasticdump.

03

Check it runs

Type elasticdump –help. If you see the usage line and a long list of options, you’re set.

04

Try a harmless first dump

Export one mapping to a file. It’s tiny, changes nothing, and proves your URL and login work.

Installing with npm (example session).
# global install
npm install elasticdump -g
elasticdump --help

# or pinned inside a project
npm install elasticdump
./node_modules/.bin/elasticdump --help

# safe first test
elasticdump \
  --input=http://localhost:9200/my_index \
  --output=my_index_mapping.json \
  --type=mapping

Elasticsearch 8+

Connecting to a secured Elasticsearch 8 cluster

Since version 8.0, Elasticsearch turns security on out of the box: HTTPS on port 9200, a generated password for the elastic user, and a self-signed certificate authority. This is where most first attempts fail, usually with a certificate error. None of the popular Elasticdump tutorials cover it, so here’s the setup that works.

Tip: you’ll see NODE_TLS_REJECT_UNAUTHORIZED=0 suggested on forums. It works by switching off certificate checks for the whole process. That’s fine on a throwaway laptop cluster, not on anything real.
# 1. get the CA cert out of the container
docker cp es01:/usr/share/elasticsearch/config/certs/http_ca.crt .

# 2. credentials via environment variables
export ELASTICDUMP_INPUT_USERNAME=elastic
export ELASTICDUMP_INPUT_PASSWORD='your-password'

# 3. dump over HTTPS with the CA
elasticdump \
  --input=https://localhost:9200/my_index \
  --input-ca=./http_ca.crt \
  --output=my_index.json \
  --type=data

Recipes

Copy-paste Elasticdump recipes

The commands people actually search for, ready to adapt. Swap the hosts and index names and you’re done.

Copy an index to another cluster

Run the three passes in this order so the target gets the right settings and field types.

for t in analyzer mapping data; do
  elasticdump \
    --input=http://prod:9200/orders \
    --output=http://staging:9200/orders \
    --type=$t
done

Back up an index to a gzip file

Compressed, readable backup in one go. Add the date so tomorrow’s run doesn’t clash.

elasticdump \
  --input=http://localhost:9200/orders \
  --output=orders-$(date +%F).json.gz \
  --type=data --fsCompress

Restore from a backup file

Same command, flipped. Load the mapping file first, then the data.

elasticdump --input=orders_mapping.json \
  --output=http://localhost:9200/orders --type=mapping
elasticdump --input=orders.json \
  --output=http://localhost:9200/orders --type=data

Export only matching documents

Keep the query in a file. It’s easier to read and avoids quoting trouble.

# errors.json -> {"query":{"term":{"level":"error"}}}
elasticdump \
  --input=http://localhost:9200/logs \
  --output=errors.json.out \
  [email protected]

Export to CSV for a spreadsheet

Use a csv:// path as the output (v6.42.0+). Check nested fields before sharing.

elasticdump \
  --input=http://localhost:9200/customers \
  --output="csv:///tmp/customers.csv"

Split a huge index into parts

Numbered files of 1 GB each are easier to move and less likely to run out of memory.

elasticdump \
  --input=http://localhost:9200/events \
  --output=/backups/events.json \
  --fileSize=1gb

Back up every index at once

multielasticdump skips dot-prefixed system indices with this regex.

multielasticdump \
  --direction=dump \
  --match='^[^.].*$' \
  --input=http://localhost:9200 \
  --output=/backups/all

Run it in Windows PowerShell

PowerShell continues lines with a backtick, not a backslash. Put JSON queries in a file.

elasticdump `
  --input=http://localhost:9200/orders `
  --output=C:\backups\orders.json `
  --type=data

Cheat sheet

The Elasticdump options you'll actually use

The README lists dozens of flags. These twenty are the ones that keep coming up, with their real defaults.

OptionWhat it doesDefault
--input / --outputSource and destination: URL, file, s3://, csv:// or $required
--typedata, mapping, analyzer, settings, alias, template, policy…data
--limitDocuments per batch100
--sizeTotal number of documents to fetch-1 (all)
--searchBodyQuery to export a subset; @file.json reads it from diskmatch_all
--sourceOnlyWrite only each document’s _sourcefalse
--overwriteReplace an existing output filefalse
--fileSize / --maxRowsSplit output into several filesoff
--fsCompressGzip file output, or read a gzipped inputoff
--scrollTimeHow long the scroll search stays open10m
--retryAttempts / --retryDelayRetry on connection errors0 / 5000 ms
--transformJavaScript applied to every documentnone
--headersExtra request headers, e.g. an API keyUser-Agent: elasticdump
--input-ca / --output-caCA certificate for HTTPS clustersnone
--noRefreshSkip index refresh during imports (faster)off
--offsetSkip N rows to roughly resume a dump0
--bulkActionindex, update, delete or createindex
--awsChainSign requests for Amazon OpenSearch Serviceoff
--searchAfter / --pitModern paging for Elasticsearch 7.17+false
--debug / --quietMore or less loggingfalse

Performance

Making big dumps faster, and safer

Elasticdump reads every document over HTTP, so on large indices the settings matter. Change one thing at a time and keep an eye on the cluster. As a rough guide, indices of a few gigabytes are comfortable territory; once you’re into hundreds of gigabytes, snapshot and restore is the better tool.

SettingUse it whenWatch out for
--limit=1000You want fewer, larger requestsBigger batches use more memory; lower it if requests time out
--noRefreshBulk-loading a fresh indexNew documents aren’t searchable until the index refreshes
--fileSize=1gbExporting a very large index to diskYou’ll restore several files instead of one
--fsCompressDisk or network is the bottleneckCosts some CPU on the machine running Elasticdump
multielasticdump --parallel=2Many indices to moveEvery fork adds load to the cluster
--retryAttempts=5Long runs over flaky networksCan hide a real problem; read the log afterwards
--scrollTime=30mThe destination is slowOpen scrolls hold resources on the source cluster

Compatibility

Compatibility

What the official notes say about cluster versions and features.

TargetStatusNotes
Elasticsearch 5.x and newerSupportedDefault queries target ES 5+ since Elasticdump 3.0.0
Elasticsearch 1.x – 4.xMay workOlder releases of Elasticdump are a safer choice
Elasticsearch 7.x+ typesChangedMapping types were removed in ES 7; old templates need updating
Elasticsearch 7.17+search_after / PITUse –searchAfter or –pit (Elasticdump 6.117.0+)
OpenSearchSupportedAdded in 6.76.0; –force-os-version overrides detection
AWS OpenSearch ServerlessSupportedAdded in 6.110.1; uses _search + POST _bulk, which can be slower
Amazon OpenSearch Service (IAM)SupportedSign requests with –awsChain or AWS key options

Version history

Breaking changes worth knowing before you upgrade

Old tutorials and scripts often assume an older Elasticdump. If a command from a 2019 blog post misbehaves, the reason is usually in this table.

VersionWhat changedWhat it means for you
1.0.0New dump file formatFiles made with 0.x won’t load in newer versions
2.0.0Bulk options removedUse multielasticdump for many indices
3.0.0Default queries target Elasticsearch 5+Very old clusters may need an older release
5.0.0S3 now uses s3:// URLss3Bucket and s3RecordKey no longer work
6.1.0Batches processed in parallelFaster, but document order isn’t guaranteed
6.32.0Node.js 8 droppedNode.js 10 or newer required
6.42.0CSV import and exportcsv:// paths work as input and output
6.67.0Node.js version checkThe tool exits right away on old Node.js
6.68.0searchBody from a file–[email protected]
6.76.0OpenSearch supportWorks against OpenSearch clusters
6.110.1AWS OpenSearch ServerlessUses _search + POST _bulk; can be slower
6.117.0search_after and point-in-time–searchAfter / –pit on ES 7.17+

Use cases

When people reach for Elasticdump

Refresh staging

Copy the mapping and a week of real orders into staging so tests stop passing on fake data.

Back up before an upgrade

Keep a readable JSON copy of the critical indices in case the upgrade goes sideways.

Seed a dev laptop

Export a small filtered sample with --searchBody and --size and load it into a local cluster.

Hand data to an analyst

Export a query as CSV so someone can open it in a spreadsheet without touching the cluster.

Move to a hosted cluster

Shift indices into a managed service where you can't register a snapshot repository.

Archive old indices

Stream last year's logs to S3, gzip them, and free up space on the hot cluster.

Honest take

Pros and cons

It’s a great tool, not a magic one. Here’s where it shines and where it struggles.

Where it shines

Where it struggles

Troubleshooting

When something goes wrong

The errors people hit most often, and the fix for each.

Since 6.67.0 Elasticdump stops if Node.js is older than 10.0.0. Run node -v, install a current LTS release, then reinstall the package with npm install elasticdump -g.

Point Elasticdump at your CA file with --input-ca or --output-ca (or --ca if both sides share it). Setting NODE_TLS_REJECT_UNAUTHORIZED=0 also works, but it disables certificate checks, so keep it for local testing only.

Inside a container, localhost means the container, not your machine. Add --net=host to docker run on Linux, or use the host’s IP address or hostname in --input.

The file transport never overwrites by default. Delete the old dump, choose a new file name, or add --overwrite if replacing it is what you want.

Check the credentials first, then the user’s privileges. The source user needs read access to the index; the destination user needs permission to create the index and write documents.

Elasticsearch creates missing indices automatically with dynamic mapping. Run --type=analyzer and --type=mapping before --type=data so your field types are in place first.

PowerShell and cmd treat quotes differently from bash. Save the query in a file and pass [email protected] instead of escaping it inline.

Split the output with --fileSize=1gb or --maxRows, and lower --limit if you raised it. If you are exporting many indices at once, reduce multielasticdump’s --parallel value.

Security

Security and privacy

Elasticdump runs on your own machine or container and talks straight to the clusters, files and buckets you name. There’s no account, no cloud service and nobody in the middle.

The real risk is the dump itself: it’s a complete copy of your documents in plain JSON. Treat it with the same care as a database backup.

Alternatives

Elasticdump alternatives

Elasticdump is one of several ways to move Elasticsearch data. Each tool fits a different job.

ToolBest forOutputTrade-off
ElasticdumpPortable copies of individual indicesJSON, CSV, S3, another clusterSlower on very large indices
Snapshot and RestoreFull backups of big clustersSnapshot repositoryRestores only into compatible versions
Reindex from remoteCluster-to-cluster copiesDirectly into the target indexNeeds remote host allow-listing on the target
LogstashOngoing pipelines with transformationAny Logstash output pluginMore setup and a separate service
Custom scroll + bulk scriptUnusual one-off migrationsWhatever you codeYou maintain the code

Quick decision guide

Community

Community and user reviews

Public numbers from GitHub and Docker Hub, plus space for reviews from your own readers.

≈7.9k stars

GitHub, Oct 2026

862 forks

GitHub, Oct 2026

10M+ pulls

Docker Hub

1,500+ commits

Long project history

Rated 0 out of 5

[Placeholder] Add a genuine review here: the reader’s own words, their name or handle, their role and the date. Delete this card if you don’t have a verified review yet.

[Reviewer name, role]

Rated 0 out of 5

[Placeholder] Add a genuine review here: the reader’s own words, their name or handle, their role and the date. Delete this card if you don’t have a verified review yet.

[Reviewer name, role]

Rated 0 out of 5

[Placeholder] Add a genuine review here: the reader’s own words, their name or handle, their role and the date. Delete this card if you don’t have a verified review yet.

[Reviewer name, role]

FAQ

Frequently asked questions

Short, practical answers about downloading, installing and using Elasticdump.

Download, Installation & Licensing

Elasticdump is published as the elasticdump package on npm and as the elasticdump/elasticsearch-dump image on Docker Hub, with source code on GitHub under the elasticsearch-dump organization. There is no separate desktop installer. Install it with npm install elasticdump -g or pull the Docker image. Elasticdump.com only links to these official sources and never hosts its own copies.

Yes. Elasticdump is open-source software released under the Apache-2.0 license. You can use it for personal and commercial work, modify it and redistribute it, as long as you keep the license and copyright notices. There are no paid tiers, license keys or usage limits built into the tool itself.

You need Node.js and npm. From version 6.67.0, Elasticdump checks the Node.js version and quits if it is older than 10.0.0. In practice a current Node.js LTS release is the safest choice. If you would rather not install Node.js at all, use the official Docker image instead.

A global install (npm install elasticdump -g) adds the elasticdump and multielasticdump commands to your PATH, which suits one-off admin work. A local install (npm install elasticdump) keeps the version pinned in a project’s package.json, which is better for scripts, CI jobs and teams that need the same version everywhere. Run the local copy from ./node_modules/.bin/elasticdump.

Pull elasticdump/elasticsearch-dump and pass the usual options after the image name. Mount a host folder with -v /data:/tmp so dump files survive after the container exits, and write to paths under /tmp. If your cluster runs on the same machine, add –net=host on Linux so localhost reaches the host instead of the container.

Run npm ls -g elasticdump to see the globally installed version, and npm view elasticdump version to see the newest one on npm. Update with npm install elasticdump@latest -g. Read the version warnings in the README before jumping across major versions, because older releases changed file formats and default queries.

Yes. It’s a Node.js tool, so it runs in PowerShell or Command Prompt once Node.js is installed. The main difference is quoting: JSON passed to –searchBody or –headers needs different escaping than in bash. Putting the JSON in a file and using the @ prefix, such as –[email protected], avoids most of those problems.

No. Elasticdump.com is an independent guide written to help people install and use the tool. It isn’t affiliated with the elasticsearch-dump maintainers, Elastic N.V. or the OpenSearch project. For bug reports and release notes, use the GitHub repository; for the package itself, use npm or Docker Hub.

Features, Security & Troubleshooting

The –type option controls it. Besides data, Elasticdump can move index, settings, analyzer, mapping, alias, template, component_template, index_template and policy definitions. A typical full copy of one index runs analyzer, then mapping, then data, so the destination index has the right settings and field types before any documents arrive.

You can embed basic auth in the URL, like http://user:password@host:9200/index, but that leaves the password in your shell history. A safer option is the ELASTICDUMP_INPUT_USERNAME and ELASTICDUMP_INPUT_PASSWORD environment variables, with ELASTICDUMP_OUTPUT_USERNAME and ELASTICDUMP_OUTPUT_PASSWORD for the destination cluster. Elasticdump reads them automatically, so the password never appears in the URL.

Yes. For API keys, send an Authorization header with –headers, for example {“Authorization”:”ApiKey “}; input-headers and output-headers variants apply it to one side only. For TLS, use –input-ca or –output-ca for the CA certificate and –cert, –key and –pass for client certificate authentication, with –tlsAuth enabling X509 client auth.

Multielasticdump is a second command installed with the same package. It wraps elasticdump and runs it in parallel across many indices, forking one process per CPU by default. With –direction=dump it writes each matching index to a folder; with –direction=load it reads that folder back into a cluster. –match filters indices with a regular expression.

Use –searchBody with an Elasticsearch query, for example a term query on one field. Only matching documents are exported. Since version 6.68.0 you can store the query in a file and reference it as –searchBody=@/path/query.json, which is easier to read, reuse and version-control than a long escaped string on the command line.

No. Since version 6.1.0, Elasticdump processes batches with overlapping promises for better throughput, which means records are not guaranteed to be written in sequence. For normal search use this rarely matters, because Elasticsearch sorts results at query time. If you need ordered output, sort the dump file afterwards.

Partly. –offset skips a number of rows from the input, so you can restart near the last logged offset, but the README warns that unsorted dumps make this approximate. If the scroll context hasn’t expired, –scrollId with the last returned ID can pick up where it stopped. For long jobs, increase –scrollTime and use –retryAttempts.

It works, but it reads every document over HTTP, so huge indices take time. Raise –limit for bigger batches, split output with –fileSize, run several indices at once with multielasticdump, and consider –noRefresh on imports. For full-cluster disaster recovery, Elasticsearch’s own snapshot and restore is usually faster.

Yes. OpenSearch support arrived in 6.76.0 and AWS OpenSearch Serverless in 6.110.1. Serverless collections don’t support the scroll API, so Elasticdump falls back to _search and POST _bulk, which can be slower. For IAM-protected Amazon domains, use –awsChain or the AWS key options so requests are signed.

Stuck on a command?

Tell us what you’re trying to move and where it’s going. We read every message, and the best questions become new guides. Bugs in Elasticdump itself belong on the GitHub issue tracker.

Scroll to Top