Elasticsearch http://www.elasticsearch.org/ is a distributed full-text search engine based on Lucene. It provides a RESTful HTTP API as well as a binary API for indexing and searching documents. Elasticsearch offers unicast and multicast discovery of nodes in a cluster.

Ports used

Dissector status

Protocol type Dissection Notes
HTTP Full Passed to HTTP dissector
Discovery Full
Binary Partial Actions, request/response type, request IDs, errors and packet length decoded.

Supported versions

In theory the dissector should work from versions of Elasticsearch >= 0.20.0RC1. This may change as the binary protocol gets more dissection work.

Example packet captures


The filter elasticsearch will include Discovery, HTTP and Binary protocols.

Code reviews

To do

Imported from https://wiki.wireshark.org/Elasticsearch on 2020-08-11 23:13:46 UTC