Elasticsearch File Ingest

Load local data files into Elasticsearch by converting them to bulk NDJSON, creating an index with the right mappings when types matter, bulk-indexing documents, and verifying the outcome.

Environment Configuration

This skill executes Elasticsearch operations through the

elastic

CLI. If the

elastic

CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g.,

GET /

GET /_cat/indices

GET /{index}/_mapping

GET /{index}/_settings/index.mode

POST /_query

). The Operations table at the end of this document maps each shorthand to the equivalent

elastic

CLI command — always use the CLI rather than calling the HTTP API directly.

Scope

This skill covers file → index loading through

POST /_bulk

. It does not use Logstash, Filebeat, Elastic Agent, Node.js ingest tools, or other sidecar pipelines. For copying documents between existing indices, use index-to-index reindex instead of re-parsing source files.

Supported source shapes:

Source shape	Example	Bulk requirement
CSV with header row	`id,name,age,...` then data rows	Parse header into field names; emit one action line + one JSON object per data row
JSON array file	`[{"a":1},{"a":2}]`	Split into per-document lines — never bulk-load the raw array as a single document
NDJSON / JSON Lines	one JSON object per line	Optionally add action lines if missing; otherwise ready for bulk

Parquet, Arrow, and other binary columnar formats are out of scope unless the user converts them to CSV or JSON first.

Process

Confirm connectivity. Call
```
GET /
```
. If the call fails, stop and resolve CLI configuration before reading files or mutating cluster state.
Inspect the source file and classify its shape. Open the file (or sample the first lines) and decide:
- CSV — first line is a comma-separated header; subsequent lines are records. Count data rows (exclude the header) — you will report this count after load.
- JSON array — file starts with
```
[
```
  and contains an array of objects. Count array elements — each element becomes one indexed document, not one.
- NDJSON — one JSON value per line; lines alternate action metadata and document source, or each line is a document that still needs a preceding action line.
The decision: pick the conversion path from NDJSON Bulk Format. Never send raw CSV text or a raw JSON array body to
```
POST /_bulk
```
.
Choose the target index name. Use the name the user supplied, or propose a lowercase name derived from the file. Index names must be lowercase, cannot contain spaces or
```
/
```
, and should not start with
```
-
```
,
```
_
```
, or
```
+
```
.
Decide whether an explicit mapping is required. Call
```
GET /{index}/_mapping
```
if the index may already exist.
Create an explicit mapping before bulk loading when:
- CSV columns include numbers, dates, or booleans that must be queryable as typed fields (not plain text).
- The user asks for usable column types or aggregation-friendly fields.
- A prior load indexed everything as
```
text
```
  /
```
keyword
```
  strings and must be corrected.
When every field can remain string-like and the user did not specify types, dynamic mapping on first bulk ingest may suffice — but prefer explicit mappings for CSV unless the user explicitly accepts all-string typing.
Read Mapping Design for Ingest for type choices. When the index exists with wrong types, ask the user before calling
```
DELETE /{index}
```
and recreating it.
Create the index when needed. When step 4 requires explicit types (or the index does not exist), call
```
PUT /{index}
```
with a
```
mappings
```
block before bulk loading. Do not rely on dynamic mapping to infer
```
long
```
,
```
date
```
, or
```
boolean
```
from CSV string cells — dynamic mapping often maps ambiguous strings to
```
text
```
with a
```
.keyword
```
sub-field.
Convert the file to bulk NDJSON. Write a temporary NDJSON file where each document occupies two lines:
- Line 1 — action metadata, e.g.
```
{"index":{"_index":"<index>"}}
```
  (add
```
"_id"
```
  only when the user requires stable IDs).
- Line 2 — document JSON with correctly typed values (numbers as JSON numbers, booleans as
```
true
```
  /
```
false
```
  , dates as ISO-8601 strings such as
```
2023-01-15
```
  ).
For CSV, map the header row to JSON field names and convert cell values to the JSON types that match the mapping from step 5. For JSON arrays, iterate each array element and emit the action line + object line pair. See worked examples in NDJSON Bulk Format.
Bulk index the documents. Call
```
POST /_bulk
```
with the NDJSON file produced in step 6. Inspect the response: if
```
errors
```
is
```
true
```
, read per-item
```
error
```
objects, fix mapping or document issues, and retry failed items after remediation. Do not assume success from a zero exit code alone.
Verify the outcome. Always confirm the load — never report counts from file inspection alone.
- Call
```
GET /{index}/_count
```
  and compare to the expected row/element count from step 2.
- When typed columns matter, call
```
GET /{index}/_mapping
```
  and confirm fields such as
```
age
```
  are numeric (
```
long
```
  /
```
integer
```
  ), dates are
```
date
```
  , and booleans are
```
boolean
```
  — not
```
text
```
  .
Report the verified document count and, when relevant, the confirmed field types. If count or mapping checks fail, see Troubleshooting.

Guidelines

Bulk only. All file loads go through
```
POST /_bulk
```
with NDJSON action lines — not single-document
```
PUT
```
loops for batch files, not ingest pipelines as a substitute for client-side CSV parsing, and not posting the untouched source file.
JSON arrays must be split. A four-element array bulk-loaded as one document yields count
```
1
```
; the correct load yields count
```
4
```
.
CSV header is schema. The first CSV row names fields; each remaining row is one document. A file with one header plus five data rows must report count
```
5
```
after ingest.
Type coercion happens in the document JSON. CSV cells arrive as strings; when mappings declare
```
long
```
,
```
date
```
, or
```
boolean
```
, emit JSON numbers, ISO date strings, and boolean literals in the bulk body — do not rely on Elasticsearch to infer types from quoted CSV strings after dynamic mapping chose
```
text
```
.
Prefer explicit mappings for typed CSV. Creating the index with
```
PUT /{index}
```
first prevents silent all-text indexing that breaks range queries and aggregations.
Idempotent re-loads. When reloading into an existing index, ask the user before deleting data. Duplicate bulk
```
index
```
actions append new documents unless
```
_id
```
is specified.

Examples

CSV with typed columns

Source (

users.csv

— header + 5 data rows):

csv

id,name,age,signup_date,active
1,Ada Lovelace,36,2023-01-15,true

Create the index with explicit types, convert rows to NDJSON (five action+document pairs for five data rows), bulk load, then verify count

and mapping types. Full walkthrough: Mapping Design for Ingest and NDJSON Bulk Format.

JSON array file

Source (

events.json

json

[
  { "event_id": "e-1", "type": "login", "user_id": 1, "value": 12.5 },
  { "event_id": "e-2", "type": "logout", "user_id": 1, "value": 0.0 }
]

Convert to four bulk line pairs for four array elements (not one pair for the whole array). Verify

GET /{index}/_count

returns

. See NDJSON Bulk Format.

NDJSON already prepared

When the file alternates action lines and document lines, validate the format and pass it directly to

POST /_bulk

after confirming the target index and mappings.

When Not to Use

Continuous or streaming ingestion — use Elastic Agent or Beats to tail logs and metrics.
Complex enrichment pipelines — design server-side ingest pipelines separately; this skill still converts files to bulk NDJSON client-side before load.
Index-to-index copy or mapping migration — reindex between indices instead of exporting to files.
Very large binary columnar files — convert to CSV or JSON offline first, then follow this skill.

References

NDJSON Bulk Format — CSV and JSON-array conversion, action-line syntax, batch sizing
Mapping Design for Ingest — explicit mappings for CSV types, eval-style schemas
Troubleshooting — wrong counts, text-typed numerics, bulk item errors

Operations

HTTP API (shorthand)	`elastic` CLI command
`GET /`	`elastic es info`
`PUT /{index}`	`elastic es indices create --index '<index>' --mappings '<json>'`
`DELETE /{index}`	`elastic es indices delete --index '<index>'`
`POST /_bulk`	`elastic es bulk --index '<index>' --input-file '<ndjson-path>'`
`GET /{index}/_count`	`elastic es count --index '<index>'`
`GET /{index}/_mapping`	`elastic es indices get-mapping --index '<index>'`

elasticsearch-ingest

NPX Install

Tags

SKILL.md Content