elasticspectre

elasticspectre — Elasticsearch and OpenSearch waste auditor. Part of SpectreHub.

What it is

• Audits Elasticsearch and OpenSearch clusters for stale indices, shard sprawl, and missing lifecycle policies
• Detects unassigned shards, oversized shards, replica waste, and frozen candidates
• Checks snapshot policies and authentication status
• Estimates storage and heap savings per finding
• Outputs text, JSON, and SpectreHub formats

What it is NOT

• Not a monitoring tool — point-in-time auditor
• Not a remediation tool — reports only, never modifies the cluster
• Not a performance tuner — flags waste, not query optimization
• Not a security scanner — checks auth status, not RBAC

Quick start

Homebrew

brew tap ppiankov/tap
brew install elasticspectre

From source

git clone https://github.com/ppiankov/elasticspectre.git
cd elasticspectre
make build

Usage

elasticspectre audit --url http://localhost:9200 --format json

CLI commands

Command	Description
elasticspectre audit	Audit cluster for waste and hygiene issues
elasticspectre init	Generate config file
elasticspectre version	Print version

SpectreHub integration

elasticspectre feeds Elasticsearch/OpenSearch waste findings into SpectreHub for unified visibility across your infrastructure.

spectrehub collect --tool elasticspectre

Safety

elasticspectre operates in read-only mode. It inspects and reports — never modifies, deletes, or alters your indices.

Documentation

Document	Contents
CLI Reference	Full command reference, flags, and configuration

License

MIT — see LICENSE.

---

Built by Obsta Labs