Link Search Menu Expand Document

Open Distro for Elasticsearch development has moved to OpenSearch. The ODFE plugins will continue to work with legacy versions of Elasticsearch OSS, but we recommend upgrading to OpenSearch to take advantage of the latest features and improvements.


The Open Distro for Elasticsearch command line interface (odfe-cli) lets you manage your ODFE cluster from the command line and automate tasks.

Currently, odfe-cli supports the Anomaly Detection and k-NN plugins, along with arbitrary REST API paths. Among other things, you can use odfe-cli create and delete detectors, start and stop them, and check k-NN statistics.

Profiles let you easily access different clusters or sign requests with different credentials. odfe-cli supports unauthenticated requests, HTTP basic signing, and IAM signing for Amazon Web Services.

This example moves a detector (ecommerce-count-quantity) from a staging cluster to a production cluster:

odfe-cli ad get ecommerce-count-quantity --profile staging > ecommerce-count-quantity.json
odfe-cli ad create ecommerce-count-quantity.json --profile production
odfe-cli ad start ecommerce-count-quantity.json --profile production
odfe-cli ad stop ecommerce-count-quantity --profile staging
odfe-cli ad delete ecommerce-count-quantity --profile staging


  1. Download and extract the appropriate installation package for your computer.

  2. Make the odfe-cli file executable:

    chmod +x ./odfe-cli
  3. Add the command to your path:

    export PATH=$PATH:$(pwd)
  4. Check that the CLI is working properly:

    odfe-cli --version


Profiles let you easily switch between different clusters and user credentials. To get started, run odfe-cli profile create with the --auth-type, --endpoint, and --name options:

odfe-cli profile create --auth-type basic --endpoint https://localhost:9200 --name docker-local

Alternatively, save a configuration file to ~/.odfe-cli/config.yaml:

    - name: docker-local
      endpoint: https://localhost:9200
      user: admin
      password: foobar
    - name: aws
        profile: ""
        service: es


odfe-cli commands use the following syntax:

odfe-cli <command> <subcommand> <flags>

For example, the following command retrieves information about a detector:

odfe-cli ad get my-detector --profile docker-local

For a request to the Elasticsearch CAT API, try the following command:

odfe-cli curl get --path _cat/plugins --profile aws

Use the -h or --help flag to see all supported commands, subcommands, or usage for a specific command:

odfe-cli -h
odfe-cli ad -h
odfe-cli ad get -h