elasticsearch-node

Display information about the current node

$ elasticsearch-node info

$ elasticsearch-node unsafe-bootstrap

$ elasticsearch-node repurpose

$ elasticsearch-node roles

$ elasticsearch-node diagnostics

$ elasticsearch-node [[-h|--help]]

elasticsearch-node generate-enrollment-token [--scope SCOPE] [--days DAYS] [--url URL]

elasticsearch-node unsafe-bootstrap-password [--no-auto-link-enrollment-token]

generate-enrollment-token
    Generates a token for enrolling nodes into a secure cluster.

--scope
    Token scope: cluster (default, joins cluster) or node (dedicated node enrollment).

--days
    Token validity in days (default: 30, range 1-1800).

--url
    Elasticsearch base URL (default: https://localhost:9200).

unsafe-bootstrap-password
    Generates/sets random bootstrap password for initial setup.

--no-auto-link-enrollment-token
    Skip auto-generating cluster enrollment token after password setup.

The elasticsearch-node command is a key utility in Elasticsearch 8.0+ for simplifying secure cluster setup.

It offers two primary actions: generate-enrollment-token creates time-limited tokens allowing new nodes to join an existing secure cluster automatically, handling transport TLS certificates and configurations. This streamlines scaling without manual certutil usage.

The unsafe-bootstrap-password action generates a random password for initial single-node bootstrap in dev/test setups, optionally linking an enrollment token.

Designed for ease, it enforces HTTPS by default, promotes security best practices, and integrates with Elasticsearch's auto-configuration. Run as the elasticsearch user from /usr/share/elasticsearch/bin/. Ideal for quick starts while guiding toward production security.

unsafe-bootstrap-password is for dev/test only; production requires manual certs and passwords. Tokens have limited lifetime; regenerate as needed. Requires Elasticsearch 8.0+.

Run as elasticsearch user. Output token: echo 'token' | elasticsearch-node enroll... on new nodes.

Enrollment token: elasticsearch-node generate-enrollment-token
Dev bootstrap: elasticsearch-node unsafe-bootstrap-password

Introduced in Elasticsearch 8.0 (Feb 2022) to automate security bootstrapping, replacing manual elasticsearch-certutil workflows for faster, secure-by-default clusters.

elasticsearch(1), elasticsearch-certutil(1), elasticsearch-keystore(1)