Package: es-peek
Peek is an interactive CLI tool for working with Elasticsearch clusters.
It is likeKibana Consolerunning in terminal with additional features for tinkers.InstallationPlease note the project requires Python 3.8+. It is recommended to install from PyPI with:pipinstalles-peekThe tool is now available as thepeekcommand. Peek will ask permission to access system keyring
for storing credentials.
This can be disabled  temporarily by invoking the command aspeek-euse_keyring=Falseor permanently by settinguse_keyring = FalseinpeekrcfileBesides HTTP calls to Elasticsearch clusters, typehelpto see a list of builtin functions.
Toenable auto-completionsfor APIs, run the_download_api_specsbuiltin function
(note the leading underscore) to download API spec file from theElasticsearch Specification project.Alternatively, peek can also be installed from source with:pythonsetup.pyinstallFeaturesPeek supports most editing features offered byKibana Console,
e.g. auto-completion, syntax highlighting, auto-formatting, auto-indent,
par-editing, triple-quotes, etc. It also offers following additional features:Lightweight CLI toolMultiplex a single terminal session to multiple Elasticsearch clusters or multiple connections to a single clusterFlexible usages of quotes, comma, comments for the JSON payload, case-insensitive http method namesMultiple authentication schemes, including UserPass, API key, Token, SAML, OIDC, Kerberos, PKISupport run-as, x-opaque-id and arbitrary request headersLoad JSON payload from external filesRun file input in batch modeReadline editing features, e.g.Ctrl-_for undo,Ctrl-rfor reverse search, etc.History managementCapture terminal input and output into fileConnect toElastic Cloudwith Cloud IDShell out for system commandsMinimal scripting supportExtensible via external scriptsSample UsagesAssuming a locally running Elasticsearch cluster, start a Peek session with:peek--hostslocalhost:9200--usernameelasticThe following sample is a quick guide on Peek usages:// Download the API schema from the elasticsearch-specification project to enable auto-completion// If the output says the schema file already exists, you can safely proceed to the next command._download_api_specs// NOTE a blank line is needed to trigger API execution, or type "ESC + Enter" to execute regardlessly// Exit the interactive session any time by pressing Ctrl-d or type exitGET/_cluster/health// comment is allowed almost anywhere// Index a single documentPOST/my-index/_doc{'foo':"bar"}// both single and double quotes are acceptable// Bulk indexing// Press <F3> to switch between pretty and compact formatting for the JSON payloadPUT_bulk{"index":{"_index":"test","_id":"1"}}{"value":"1","category":"click"}{"index":{"_index":"test","_id":"2"}}{"value":"2","category":"click"}// Auto encoding for date math expression// The following is encoded automatically into "PUT /%3Cmy-index-%7Bnow%2Fd%7D%3E" on the backgroundPUT/<my-index-{now/d}>// Shell out to download the EQL threat hunting demo file!curl-onormalized-T1117-AtomicRed-regsvr32.jsonhttps://raw.githubusercontent.com/elastic/elasticsearch/master/docs/src/test/resources/normalized-T1117-AtomicRed-regsvr32.json// Bulk indexing the above downloaded filePOSTmy-index-000001/_bulk@normalized-T1117-AtomicRed-regsvr32.json// Execute an EQL query (triple quotes can be either ''' or """)GET/my-index-000001/_eql/search?filter_path=-hits.events{"query":"""
    any where process.name == "regsvr32.exe"
  ""","size":200}// Create an API keyPUT_security/api_key{"name":"key-1",// extra comma is OK, and this comment is ok as well}// Connect using the above generated API key// The dot notation is used to index into JSON object and arrayconnectapi_key=_.'id'+":"+_.'api_key'hosts='localhost:9200'// Quotes are necessary for strings// Connect to Elastic Cloud with Cloud IDconnectcloud_id='YOUR_CLOUD_ID'username='elastic'// Issue a call to the cloud clusterget/// HTTP method is case-insensitiveget/conn=0// send the request to the first connection (zero-based index) with the conn option// Check configuration location and valuesconfig// List available connectionsconnectionconnection@info// check detailsconnectionrename='my-cloud-cluster'// give a friendly name to the current connectionconnection0// switch to the first connectionconnectionremove=0// remove the first connectionconnection'my-cloud-cluster'// switch to the cloud cluster connection// Save the connections we have so far. Session is also auto-saved on exit.session@save// it can be loaded later with "session @load"// Session auto-load on start up can be enabled by set "auto_load_session = True" in peekrc file.// This helps preserving connections across restart.// Builtin helphelp// list available functionshelpsession// a bit more detailed info about the "session" builtin function// Capture the terminal I/Ocapture@startcapture// show capture status// Run-AS and other headersGET_security/_authenticaterunas='foo'xoid='my-x-opaque-id'headers={'some-other-header':'blah'}// Show only the first role from previous responseecho_."roles".0// If the cluster has SAML integration configured, authenticate with saml// Note this opens a web browser to perform the front-channel flowsaml_authenticate// Load and run an external scriptrun'my-setup.es'// Stop the capturecapture@stop// Minimal scripting for populating an indexlettags=range(0,100)foriintags{PUT("my-index/_doc/"+i){'tag':i,"value":i*i}}// Or with bulk indexforiinrange(1,100){// first prepare the payload fileecho{"index":{"_index":"test","_id":""+i}}file='payload.json'echo{"value":i,"category":"click"}file='payload.json'}// Now bulk indexing with the above generated filePUT_bulk@payload.jsonThe tool can also run in batch mode. Assuming above commands are saved in a file calledscript.es,
it can be executed as:# Positional argumentpeekscript.es# Pipecatscript.es|peek# Or with heredocpeek<< EOF
GET /_cluster/health
// etc
EOFExternal scripts can used to provide extra functions. They are simple Python scripts that define
and expose callabes under a variable namedEXPORTS. Please refernatives.pyfor examples.Please also readUsagesfor more details.CreditsPgclihas been a great reference of learning how to useprompt-toolkit, which is a critical
dependency of this project.