add esql sample

add feature esql search (#90 )
fix api header spec (#89 )
2026-08-24 07:44:17 +02:00 · 2026-07-10 15:14:23 +02:00 · 2026-07-10 15:07:57 +02:00 · 2026-07-10 13:58:56 +02:00 · 2026-07-10 13:37:59 +02:00 · 2026-07-10 11:28:25 +02:00
86 changed files with 7162 additions and 1800 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -32,3 +32,6 @@ esctl
 *.log

 cpu.profile
+
+t
+single
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -0,0 +1,110 @@
+version: "2"
+
+linters:
+  enable:
+    - errcheck
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - arangolint
+    - asasalint
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - canonicalheader
+    - clickhouselint
+    - containedctx
+    #- contextcheck
+    - copyloopvar
+    #- cyclop
+    - decorder
+    - dogsled
+    - dupword
+    - durationcheck
+    - embeddedstructfieldcheck
+    - errchkjson
+    - errname
+    #- errorlint
+    - exhaustive
+    - exptostd
+    - fatcontext
+    - funcorder
+    #- funlen
+    - ginkgolinter
+    - gocheckcompilerdirectives
+    - gochecknoinits
+    - gochecksumtype
+    #- gocognit
+    - gocritic
+    #- gocyclo
+    #- godoclint
+    - goheader
+    - gomoddirectives
+    - gomodguard_v2
+    - goprintffuncname
+    #- gosec
+    - gosmopolitan
+    - grouper
+    - iface
+    - importas
+    - inamedparam
+    - interfacebloat
+    - intrange
+    - iotamixing
+    - lll
+    - loggercheck
+    - makezero
+    - misspell
+    - modernize
+    - nakedret
+    #- nestif
+    - nilerr
+    - nilnesserr
+    - nlreturn
+    - nonamedreturns
+    - nosprintfhostport
+    - paralleltest
+    - perfsprint
+    - prealloc
+    #- predeclared
+    - promlinter
+    - protogetter
+    - reassign
+    - recvcheck
+    #- revive
+    - rowserrcheck
+    - sloglint
+    - spancheck
+    - sqlclosecheck
+    - tagalign
+    - testableexamples
+    - testifylint
+    - testpackage
+    - thelper
+    - tparallel
+    - unconvert
+    - unparam
+    - unqueryvet
+    - usestdlibvars
+    - usetesting
+    - varnamelen
+    - wastedassign
+    - whitespace
+    - wsl_v5
+    - zerologlint
+
+  settings:
+    varnamelen:
+      ignore-names:
+        - err
+        - wg
+        - mu
+        - ts
+        - to
+        - es
+        - op
+        - fd
+        - id
+        - fn
+      
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -2,7 +2,7 @@ matrix:
  platform:
    - linux/amd64
  goversion:
-    - 1.25.8
+    - 1.26.4

 labels:
  platform: ${platform}
@@ -21,6 +21,6 @@ steps:
      event: [push,manual]
    image: golang:${goversion}
    commands:
-      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.5.0
+      - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.12.2
      - golangci-lint --version
      - golangci-lint run ./...
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -12,6 +12,13 @@ The  programming  language  used  for  this  project  will  always  be

 # Contributing

+Everyone can contribute to this project except you are using "AI"
+(LLM) generated content (code, issue text, etc), even if only a part
+of it is. This is a human made project. It is being made to have fun
+at work and learning coding and APIs. If you want fast results without
+the hassle to invest time then please refrain from
+contributing.
+
 You can contribute to this project in various ways:

 ## Open an issue
--- a/13
+++ b/13
@@ -62,17 +62,16 @@ install: buildlocal
 clean:
 	rm -rf $(tool) coverage.out testdata t/out pkg/es/openspec.go

-test: clean
-	mkdir -p t/out
-	go test ./... $(ARGS)
+test: clean buildlocal
+	make -C t test

 testlint: test lint

-lint:
-	golangci-lint run
+lint-basic:
+	golangci-lint run --enable-only errcheck,govet,ineffassign,staticcheck,unused

-lint-full:
-	golangci-lint run --enable-all --exclude-use-default --disable exhaustivestruct,exhaustruct,depguard,interfacer,deadcode,golint,structcheck,scopelint,varcheck,ifshort,maligned,nosnakecase,godot,funlen,gofumpt,cyclop,noctx,gochecknoglobals,paralleltest
+lint:
+	golangci-lint run --show-stats=false

 testfuzzy: clean
 	go test -fuzz ./... $(ARGS)
--- a/README.md
+++ b/README.md
@@ -1,4 +1,8 @@
 [![status-badge](https://ci.codeberg.org/api/badges/16999/status.svg)](https://ci.codeberg.org/repos/16999)
+[![humanmande](https://img.shields.io/badge/human-made-green)](CONTRIBUTING.md)
+[![License](https://img.shields.io/badge/license-GPL-blue.svg)](https://codeberg.org/scip/esctl/blob/master/LICENSE)
+[![Go Report Card](https://goreportcard.com/badge/codeberg.org/scip/esctl)](https://goreportcard.com/report/codeberg.org/scip/esctl)
+[![Latest Release](https://flat.badgen.net/codeberg/release/scip/esctl)](https://codeberg.org/scip/esctl/releases)

 # esctl

@@ -19,25 +23,36 @@ Features:
 - Shell completion support (bash, zsh and fish). Put this into your
  rc: `source <(esctl completion bash)`.
 - Cluster settings can be viewed and modified.
+- Comprehensive cluster status.
+- Cluster reroute support.
 - Search: you can search indices using full text or by fields, select
  logical condition (OR, AND), use PIT, limit datetime (ES date math
  can be used), etc. It is however not yet possible to create
  recursive searches like: `(cond1 AND cond2) OR (cond3 OR cond4)`.
+- Search using ES|QL language: `esctl searchql`.
 - Cross cluster replication (ccr): view, pause, resume, delete
  replication. You can also manage follower configuration.
 - Index management: manage aliases, create, modify, delete indices,
-  display field mappings etc.
+  display field mappings etc. Automatic rollover of aliases supported.
+- Index template management: create, modify, delete etc
+- Index alias management: create, modify, delete etc
 - Node management: only list nodes yet.
 - Shard management: only list shards yet.
 - Snapshot management: only list snapshots yet.
+- ILM management: list, create, delete etc. 
+- Task management: list and cancel tasks
 - Role management: only list roles yet. There's also a `role diff`
  subcommand, which is for internal use. It can be used to verify if
  role defs in a CSV match the deployed roles.
+- API  documentation   (`api  list`  and  `api   show  <path>`)  with
+  interactive markdown pager for endpoint documentation.
 - Repl: this is an interactive REPL (read eval print loop) towards the
-  elasticsearch API. You can run API calls on the current selected
+  elasticsearch API.  You can  run API calls  on the  current selected
  cluster w/o the hassle to specify the whole url, credentials etc. It
-  has line editing and history support. If `jq` is installed output
-  JSON will be syntax highlighted.
+  has line  editing and history  support. If `jq` is  installed output
+  JSON will  be syntax  highlighted. A simple  internal pager  will be
+  used if output exceeds the terminal height. You can tweak this using
+  the `$ES_JSON_PAGER` environment variable (I'd recommend [fx](https://fx.wtf/)).
 - Doc support. You can put, delete and show docs for an index. Very
  handy if you want to play with it. Just create a new index:
  `esctl index create foo` and then insert docs into it for search
@@ -46,121 +61,6 @@ Features:
  esctl doc add -i foo '{"title":"curry in a hurry", "message":"australian thai"}'
  ```

-## Usage
-
-Command tree:
-
-```console
- api
-     list
-     repl
-     show
- ccr
-     follower
-         add
-         delete
-         pause
-         renew
-         resume
-         show
-         unfollow
-     info
-     pause
-     resume
-     status
- cluster
-     list
-     settings
-         list
-         set
-     status
- datastream
-     create
-     delete
-     list
-     rollover
-     show
- debug
- doc
-     add
-     delete
-     show
- help
- help-jsonpath
- ilm
-     create
-     list
-     retry
-     show
-     status
- index
-     alias
-         create
-         delete
-         list
-         rollover
-     allocation
-     close
-     create
-     delete
-     fields
-     ilm
-     list
-     modify
-     show
-     template
-         create
-         delete
-         list
-         modify
-         show
- node
-     list
-     show
- role
-     diff
-     list
-     show
- search
- shard
-     list
-     show
- snapshot
-     list
-     show
- task
-     cancel
-     list
- version
-```
-
-Configure `esctl` with environment variables:
-
- `ES_URI`: elasticsearch uri
- `ES_USER`: username
- `ES_PASS`: password
-
-Or create a config file such as this:
-
-```yaml
-clusters:
-  default:
-    uri: https://es.foo.bar:9200/
-    user: elastic
-    pass: 123456
-  other:
-    uri: https://myes.foo:9200/
-    user: elastic
-    pass: asdasdasd
-```
-
-and specify it with `-c configfile`.  You may also put clusters into a
-default config file in `~/.config/esctl/config.yaml`. In this case you
-can omit `-c ...`.
-
-If you want to  work on a specific cluster, specify  its name with the
-global `-C` option.
-
 ## Installation

 The tool does not have any dependencies.  Just download the binary for
@@ -211,6 +111,499 @@ make
 sudo make install
 ```

+## Configure
+
+Configure `esctl` with environment variables:
+
+- `ES_URI`: elasticsearch uri
+- `ES_USER`: username
+- `ES_PASS`: password
+- `ES_TOKEN`: API token, instead of user+password
+
+Or create a config file such as this:
+
+```yaml
+clusters:
+  foobar:
+    uri: https://es.foo.bar:9200/
+    user: elastic
+    pass: ******
+  other:
+    uri: https://myes.foo:9200/
+    token: ******
+```
+
+and specify it with `-c configfile`.  You may also put clusters into a
+default config file in `~/.config/esctl/config.yaml`. In this case you
+can omit `-c ...`.
+
+If you want to  work on a specific cluster, you need to make it the
+current default one. You can either manually configure it in the
+config:
+
+```yaml
+clusters:
+  foobar:
+    uri: https://es.foo.bar:9200/
+    user: elastic
+    pass: 123456
+    default: true
+```
+
+or - if the cluster already exists in the config - issue this command:
+
+```console
+esctl cluster switch foobar
+```
+
+You may also temporary set a cluster as the current default with the
+global `-C` option.
+
+The following rules apply for default cluster selection:
+
+1. If there's just one cluster configured (either via environment
+   variables or config), this one will be selected.
+2. If a cluster have been specified with `-C <name>`, use this.
+3. If there is one cluster configured with the `default` flag `true`,
+   use this one.
+   
+Use `esctl cluster ls` to check status and see which one would be
+used.
+
+Please be aware, that prior to use a cluster and send API requests to
+it, `esctl` checks the connectivity to it first.
+
+## Usage
+
+Once you have configured one or more (and marked one as the default,
+see above) elasticsearch clusters, you can start using `esctl`. Since
+there are just too many things you can do with it, we'll just outline
+a couple of examples here.
+
+To see the status of a cluster:
+
+```console
+$ esctl cluster status 
+DEFAULT                    STATUS                 
+Cluster Name               eck-cluster-dev-s1
+ES Status                  green                  
+ES Version                 9.4.2                  
+Is Leader                  true                   
+Active Shards              447                    
+Active Primary Shards      221                    
+Unassigned Shards          0                      
+Unassigned Primary Shards  0                      
+Pending Tasks              0                      
+Nodes                      3                      
+Red Indices                0                      
+Long Running Tasks         2 
+```
+
+you may also add the `-v` flag to see more:
+
+```console
+$ esctl cluster status -v
+DEFAULT                    STATUS                              
+Cluster Name               eck-cluster-dev-s1             
+ES Status                  green                               
+ES Version                 9.4.2                               
+Is Leader                  true                                
+Active Shards              447                                 
+Active Primary Shards      221                                 
+Unassigned Shards          0                                   
+Unassigned Primary Shards  0                                   
+Pending Tasks              0                                   
+Nodes                      3                                   
+Red Indices                0                                   
+Long Running Tasks         2                                   
+Indicies                   221                                 
+Docs                       9854777                             
+Total Size                 3.4 GB                              
+Total Queries              4210411                             
+Shards Primaries           824642680872                        
+Shards Total               824642680808                        
+Storage                    6.9 GB/6.9 GB                       
+JVM Heap Memory            16 GB/39 GB                         
+JVM Threads                458                                 
+JVM Version                OpenJDK 64-Bit Server VM 26.0.1+8-34
+CPUs                       18                                  
+CPU Usage                  0%                                  
+Open FDs                   1423 
+```
+
+View cluster settings:
+
+```console
+$ esctl cluster settings list 
+SETTING                                         VALUE              
+cluster.remote.svct13.mode                      proxy              
+cluster.remote.svct13.proxy_address             100.127.161.24:9300
+cluster.remote.svct13.proxy_socket_connections  18                 
+cluster.remote.svct13.skip_unavailable          false              
+cluster.routing.allocation.enable               all                
+indices.recovery.max_bytes_per_sec              320mb 
+```
+
+Settings can be changed, use json path to specify a setting:
+
+```console
+$ esctl cluster settings set indices.recovery.max_bytes_per_sec:480mb
+```
+
+Searching is pretty easy. First check which indices exist:
+
+```console
+$ esctl index ls                                         
+NAME                                             SIZE     DOCSCOUNT
+[..]
+foo                                              249b     0        
+foo2                                             31.4kb   14       
+mock                                             9.6kb    20       
+mr-strange                                       249b     0        
+silo18                                           5.2kb    1 
+```
+
+Like a dataview in kibana you can specify an index pattern for search:
+
+```console
+$ esctl search -i foo*
+{"id":"1779873299", "score":1.0000, "index":"foo2", "source":{"message":"foo bar"}}{"id":"1779870997", "score":1.0000, "index":"foo2", "source":{"message":"start","time":"27.05.2026T10:55:33+0200","title":"zeitbuchung"}}{"id":"1779870750", "score":1.0000, "index":"foo2", "source":{"message":"pause","time":"27.05.2026T10:33:45+0200","title":"zeitbuchung"}}{"id":"1779870103", "score":1.0000, "index":"foo2", "source":{"message":"punktlich gebucht","time":"27.05.2026T10:20:01+0200","title":"zeitbuchuung"}}{"id":"1779432806", "score":1.0000, "index":"foo2", "source":{"message":"strange compound 2"}}{"id":"1779432750", "score":1.0000, "index":"foo2", "source":{"message":"strange compound 1"}}{"id":"1778600947", "score":1.0000, "index":"foo2", "source":{"id":"d8d8d","user":"scip"}}{"id":"1778600945", "score":1.0000, "index":"foo2", "source":{"id":"d8d8d","user":"scip"}}{"id":"1778600857", "score":1.0000, "index":"foo2", "source":{"id":"d8d8d","user":"scip"}}{"id":"1778601788", "score":1.0000, "index":"foo2", "source":{"id":"new1","message":"live long and prosper"}}{"id":"1778601422", "score":1.0000, "index":"foo2", "source":{"id":"new1","message":"love long and prosper"}}{"id":"1779447242", "score":1.0000, "index":"foo2", "source":{"message":"australian thai","title":"curry in a hurry"}}{"id":"1779447284", "score":1.0000, "index":"foo2", "source":{"message":"german killer food","title":"wuerger burger"}}{"id":"1779364394", "score":1.0000, "index":"foo2", "source":{"id":"1","message":"non-dead human looks curious at TargetOne"}}
+```
+
+Oops, that looks gibberish. It's because `esctl` just prints the raw
+JSON search results. There are multiple ways to post-process them:
+
+You can use `jq` (here, we're using `-l 1` to limit the output to 1 document):
+
+```console
+$ esctl search -i foo* -l 1 | jq
+{
+  "id": "1779364394",
+  "score": 1.0000,
+  "index": "foo2",
+  "source": {
+    "id": "1",
+    "message": "non-dead human looks curious at TargetOne"
+  }
+}
+```
+
+However, you might as well use internal filtering using jsonpaths:
+
+```console
+$ esctl search -i foo* -l 1 -p source.message
+non-dead human looks curious at TargetOne
+```
+
+To get more help about internal jsonpath filtering, run `esctl
+help-jsonpath`.
+
+A full text search looks like this:
+
+```console
+$ esctl search -i foo* thai | jq
+{
+  "id": "1779447242",
+  "score": 2.3842,
+  "index": "foo2",
+  "source": {
+    "message": "australian thai",
+    "title": "curry in a hurry"
+  }
+}
+```
+
+Instead of a costly full text you might as well specify the field to
+search within:
+
+```console
+$ esctl search -i foo* message=thai  | jq
+{
+  "id": "1779447242",
+  "score": 2.3842,
+  "index": "foo2",
+  "source": {
+    "message": "australian thai",
+    "title": "curry in a hurry"
+  }
+}
+```
+
+Of course you can search for multiple fields (or multiple terms in
+full text search). By default search terms are applied using logical
+AND, which you can change with the option `--or`.
+
+You can also change the sorting (`--sort-by`) and the time range
+(`--timerange`).
+
+To further narrow down search results you can add filters, which must
+match literally:
+
+```console
+$ esctl search -i foo* -F title=zeitbuchung message=pause | jq
+{
+  "id": "1779870750",
+  "score": 2.8426,
+  "index": "foo2",
+  "source": {
+    "message": "pause",
+    "time": "27.05.2026T10:33:45+0200",
+    "title": "zeitbuchung"
+  }
+}
+```
+
+You can also search using [ES|QL](https://www.elastic.co/docs/reference/query-languages/esql/esql-getting-started):
+
+```console
+$ esctl searchql "from hyperdrive | sort @timestamp | limit 5" 
+@TIMESTAMP                MESSAGE     TAG
+2026-06-24T08:24:56.000Z  arosu       loop
+2026-06-24T08:24:58.000Z  hami        loop
+2026-06-24T08:24:59.000Z  ishininu    loop
+2026-06-24T08:25:00.000Z  uyomoruron  loop
+2026-06-24T08:25:02.000Z  ishimime    loop
+```
+
+There are several output modes (json, yaml, csv), to get esql output as CSV:
+
+```console
+$ esctl searchql "from hyperdrive | sort @timestamp | limit 5"  -o csv
+@timestamp,message,tag
+2026-06-24T08:24:56.000Z,arosu,loop
+2026-06-24T08:24:58.000Z,hami,loop
+2026-06-24T08:24:59.000Z,ishininu,loop
+2026-06-24T08:25:00.000Z,uyomoruron,loop
+2026-06-24T08:25:02.000Z,ishimime,loop
+```
+
+To check which field mappings are available for an index:
+```console
+$ esctl index show foo2 
+INDEX-PROPERTY  VALUE                     
+name            foo2                      
+replicas        1                         
+shards          1                         
+created         2026-05-12 17:47:37       
+uuid            XmRtlh_JSreIzTB7jJNNJA    
+fields          id,message,time,title,user
+```
+
+Now, let's create a new index:
+
+```console
+$ esctl index create hyperdrive @timestamp:date message:keyword tag:text
+
+esctl index show hyperdrive 
+INDEX-PROPERTY  VALUE                 
+name            hyperdrive            
+replicas        1                     
+shards          1                     
+created         2026-06-24 10:16:23   
+uuid            gYfUj8TiR6aMB_BHmMYr3Q
+fields          @timestamp,message,tag
+```
+
+Once we have an index, we can insert documents into it (you'll need
+[gfn](https://codeberg.org/scip/gfn) for this):
+
+```console
+$ for name in $(gfn JapaneseNamesDiverse -n 20); do \
+     esctl doc add -i hyperdrive \
+     "{\"message\":\"$name\",\"tag\":\"loop\",\"@timestamp\":\"$(date
+     --iso-8601=second)\"}"; \
+     sleep 1; \
+  done
+3644770736267480972
+1249004675657072369
+5499556813583921546
+947619563748335783
+6804953496467561176
+1716813071323879201
+463762522269463473
+4674152788118344945
+7741776772191747414
+8531321287239151007
+3335734000533108391
+7020487792409206103
+4926995290680601261
+374509677635815298
+49895974689085266
+7603943644788310
+2102931816420108217
+696238814931581311
+2463257155346426021
+596556586001412147
+```
+
+Now, let's search them:
+
+```console
+$ esctl search -i hyperdrive -l 2 | jq
+{
+  "id": "2463257155346426021",
+  "score": 0.0000,
+  "index": "hyperdrive",
+  "source": {
+    "@timestamp": "2026-06-24T10:25:19+02:00",
+    "message": "inenen",
+    "tag": "loop"
+  }
+}
+{
+  "id": "596556586001412147",
+  "score": 0.0000,
+  "index": "hyperdrive",
+  "source": {
+    "@timestamp": "2026-06-24T10:25:20+02:00",
+    "message": "ominuhen",
+    "tag": "loop"
+  }
+}
+```
+
+There are also some uniq features which are not directly available via
+the ES API or GUI. Here's one example: say you have a number of
+indices with ILM policies each. At some day there were a surge in
+incoming data in some of them and you want to know, when the excess
+data will be rolled over to cold storage:
+
+```console
+$ esctl ilm forecast sh -f warm -w 3d 
+1.1 TB bytes of data in warm phase will be rolled within 72h0m0s to the next phase
+```
+
+You may also look at a detailed ilm forecast list:
+
+```console
+$ esctl ilm forecast ls -f warm -w 3d
+INDEX                           CURRENT-SIZE  CURRENT-AGE  VIRTUAL-AGE  MIN-AGE  MIN-SIZE  CURRENT-PHASE  NEXT-PHASE
+foobar-n1-p01-elastic-000126    12 GB         2d:8h:12m    3d:5h:16m    7d       25 GB     hot            warm      
+foobar-n1-p01-misc-000070       16 GB         5d:16h:31m   4d:10h:31m   7d       25 GB     hot            warm      
+foobar-n1-q01-elastic-000122    23 GB         5d:0h:11m    6d:10h:33m   7d       25 GB     hot            warm      
+foobar-n1-q01-misc-000072       18 GB         6d:15h:21m   4d:21h:36m   7d       25 GB     hot            warm      
+delaware-f1-p01-kafka-000023    1.3 MB        15h:12m      0s           7d       25 GB     hot            warm      
+delaware-f1-p01-misc-000024     17 GB         6d:16h:1m    4d:16h:33m   7d       25 GB     hot            warm      
+delaware-f1-q01-kafka-000023    1.5 MB        15h:12m      0s           7d       25 GB     hot            warm      
+delaware-f1-q01-misc-000024     16 GB         6d:15h:31m   4d:13h:52m   7d       25 GB     hot            warm      
+delaware-n1-p01-elastic-000417  16 GB         12h:42m      4d:10h:31m   7d       25 GB     hot            warm 
+```
+So you can see, which index will be rolled over when. Note the
+**VIRTUAL-AGE** field however: it is calculated from the current
+storage usage of the index in relation to rollover max shard size. So
+you can see, when an index will be rolled over either because it aged
+out or because its storage exceeded the limit.
+
+---
+
+Please note, that `esctl` is still in its early stages and things are
+changing heavily every now and then. New commands are being added
+constantly as well.
+
+### Command tree:
+
+```console
+api                         - api access and documentation
+  list                      - list index of API calls
+  show                      - show an API doc
+  repl                      - interactive API repl
+ccr                         - manage cross cluster replication
+  status                    - cross cluster replication status (yaml config with 2 clusters required)
+  pause                     - pause shard allocation
+  resume                    - resume shard allocation
+  follower                  - manage ccr follower indices
+    show                    - show ccr follower index details
+    add                     - add ccr follower index
+    delete                  - delete ccr follower index
+    unfollow                - unfollow ccr follower index
+    pause                   - pause ccr index to follow
+    resume                  - resume ccr index to follow
+    renew                   - renew ccr follower index
+  info                      - show ccr remote info
+cluster                     - manage cluster[s]
+  status                    - show cluster status
+  switch                    - set current elasticsearch cluster
+  list                      - list configured clusters
+  settings                  - cluster settings management
+    list                    - show cluster settings
+    set                     - set|update cluster settings
+  reroute                   - manually change the allocation of individual shards in the cluster.
+    move                    - move shard to another node
+    allocate-replica        - allocate-replica replica to another node
+    cancel                  - cancel a reroute operation
+    allocate-empty-primary  - allocate an empty primary shard to a node
+    allocate-stale-primary  - allocate a stale primary shard to a node
+datastream                  - manage data streams
+  list                      - list indicies
+  show                      - show details about an data stream
+  create                    - create a new data stream
+  delete                    - delete a data stream
+  rollover                  - roll over a data stream
+doc                         - manage documents
+  add                       - add JSON document index
+  show                      - show a JSON document
+  delete                    - delete JSON document[s] from index[es]
+ilm                         - manage index lifecycle
+  retry                     - retry applying an ILM profile to an index
+  status                    - get the current index lifecycle management status
+  list                      - list index lifecycle policies
+  show                      - show details about an index lifecycle policy
+  create                    - create a new lifecycle policy
+  update                    - update an lifecycle policy
+  forecast                  - calculate index phase movements
+    list                    - list index rollover config
+    show                    - show rollover forecast over all indices
+  explain                   - explain ilm condition of an index
+index                       - manage indicies
+  list                      - list indicies
+  show                      - show details about an index
+  create                    - create a new index
+  update                    - update an index
+  delete                    - delete an index
+  close                     - close an index
+  fields                    - show info about field capabilities
+  ilm                       - show ilm status
+  du                        - show index disk usage
+  alias                     - manage index aliases
+    create                  - create an index alias
+    list                    - list index aliases
+    delete                  - delete an index alias
+    rollover                - roll over an index alias
+  template                  - manage index templates
+    list                    - list index templates
+    show                    - show details about an index template
+    create                  - create a new index template
+    update                  - update a new index template
+    delete                  - delete an index template
+license                     - manage cluster license
+  show                      - show details about the cluster license
+node                        - manage nodes
+  list                      - list nodes
+  show                      - show details about a node
+  clients                   - show node http clients
+  usage                     - show node usage stats
+role                        - manage roles
+  list                      - list roles
+  show                      - show details about a role
+  diff                      - show differences between roles and CSV baseline
+search                      - search within an index
+shard                       - manage shards
+  list                      - list shards
+  show                      - show details about a shard
+  allocation                - explain shard allocation
+snapshot                    - manage snapshots
+  list                      - list snapshots
+  show                      - show details about a snapshot
+task                        - manage tasks
+  list                      - list tasks
+  cancel                    - cancel running task
+version                     - show esctl version information
+debug                       - developer only
+help-jsonpath               - show jsonpath help
+help-usage                  - show overview of all available commands
+help-esql                   - show esql help
+```
+
 # Development

 ## To test completion
--- a/TODO.md
+++ b/TODO.md
@@ -3,10 +3,6 @@

 - index show: add more details, see screenshots

- add shard explain, aka:
-  get /_cluster/allocation/explain {"index":"yourindex", "primary": true, "shard":0}
-
-
 - add datastream support:
  https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-get-data-stream
  
--- a/assets/assets.go
+++ b/assets/assets.go
@@ -24,10 +24,11 @@ import (
 	"github.com/go-openapi/swag/loading"
 )

-//go:embed *.json
+//go:embed *.json *.md
 var AssetFS embed.FS

 var OpenAPI *loads.Document
+var EsQlCheatSheet string

 func LoadAssetOpenApi() {
 	doc, err := loads.Spec(
@@ -41,3 +42,12 @@ func LoadAssetOpenApi() {

 	OpenAPI = doc
 }
+
+func LoadEsql() {
+	md, err := AssetFS.ReadFile("esql.md")
+	if err != nil {
+		panic(err)
+	}
+
+	EsQlCheatSheet = string(md)
+}
--- a/assets/esql.md
+++ b/assets/esql.md
@@ -0,0 +1,951 @@
+<!-- courtesy https://github.com/linkan-per/ES-QL-Cheat-Sheet by |linkan-per -->
+# ES|QL (Elasticsearch Query Language) Cheat Sheet
+
+## Table of Contents
+1. [Introduction](#introduction)
+2. [Basic Query Structure](#basic-query-structure)
+3. [Source Commands](#source-commands)
+4. [Processing Commands](#processing-commands)
+5. [Data Selection & Filtering](#data-selection--filtering)
+6. [Aggregations & Statistics](#aggregations--statistics)
+7. [String Functions](#string-functions)
+8. [Mathematical Functions](#mathematical-functions)
+9. [Date/Time Functions](#datetime-functions)
+10. [Type Conversion Functions](#type-conversion-functions)
+11. [Conditional Functions](#conditional-functions)
+12. [Array Functions](#array-functions)
+13. [Join Operations (LOOKUP)](#join-operations-lookup)
+14. [Sorting & Limiting](#sorting--limiting)
+15. [Grouping & Aggregating](#grouping--aggregating)
+16. [Advanced Patterns](#advanced-patterns)
+
+---
+
+## Introduction
+
+ES|QL is Elasticsearch's new query language designed for data exploration, analysis, and transformation. It uses a pipe (`|`) syntax to chain commands together.
+
+**Basic Syntax:**
+```
+FROM <data-source>
+| <processing-command>
+| <processing-command>
+| ...
+```
+
+---
+
+## Basic Query Structure
+
+### Simple Query
+```esql
+FROM logs-*
+| LIMIT 10
+```
+
+### Query with Multiple Commands
+```esql
+FROM employees
+| WHERE department == "Engineering"
+| KEEP name, salary, hire_date
+| SORT salary DESC
+| LIMIT 5
+```
+
+---
+
+## Source Commands
+
+### FROM - Specify Data Source
+```esql
+// From a single index
+FROM logs-2024
+
+// From multiple indices with wildcard
+FROM logs-*, metrics-*
+
+// From specific indices
+FROM index1, index2, index3
+
+// With metadata
+FROM logs-* METADATA _id, _index
+```
+
+### ROW - Generate Inline Data
+```esql
+// Create a single row
+ROW name = "John", age = 30, city = "NYC"
+
+// Multiple rows
+ROW a = 1, b = "x"
+| EVAL c = a * 10
+```
+
+---
+
+## Processing Commands
+
+### KEEP - Select Specific Fields
+```esql
+FROM employees
+| KEEP name, department, salary
+
+// Keep with pattern
+FROM logs-*
+| KEEP @timestamp, message, host.*
+```
+
+### DROP - Remove Specific Fields
+```esql
+FROM employees
+| DROP password, ssn, internal_notes
+
+// Drop with pattern
+FROM logs-*
+| DROP *.keyword
+```
+
+### RENAME - Rename Fields
+```esql
+FROM employees
+| RENAME emp_name AS name, emp_dept AS department
+
+// Multiple renames
+FROM logs-*
+| RENAME source.ip AS src_ip, destination.ip AS dst_ip
+```
+
+---
+
+## Data Selection & Filtering
+
+### WHERE - Filter Rows
+```esql
+// Equality
+FROM employees
+| WHERE department == "Sales"
+
+// Comparison operators
+FROM products
+| WHERE price > 100 AND stock < 50
+
+// IS NULL / IS NOT NULL
+FROM logs-*
+| WHERE error_code IS NOT NULL
+
+// IN operator
+FROM employees
+| WHERE department IN ("Sales", "Marketing", "HR")
+
+// LIKE operator (wildcards)
+FROM logs-*
+| WHERE message LIKE "*error*"
+
+// RLIKE operator (regex)
+FROM logs-*
+| WHERE message RLIKE "error|exception|failure"
+
+// NOT operator
+FROM employees
+| WHERE NOT department == "IT"
+
+// Multiple conditions
+FROM orders
+| WHERE status == "completed" 
+  AND total_amount > 1000 
+  AND order_date >= "2024-01-01"
+```
+
+---
+
+## Aggregations & Statistics
+
+### STATS - Aggregate Functions
+
+#### COUNT
+```esql
+// Count all rows
+FROM logs-*
+| STATS count = COUNT()
+
+// Count distinct
+FROM employees
+| STATS unique_departments = COUNT_DISTINCT(department)
+
+// Count by group
+FROM logs-*
+| STATS event_count = COUNT() BY log_level
+```
+
+#### SUM, AVG, MIN, MAX
+```esql
+FROM sales
+| STATS 
+    total_revenue = SUM(amount),
+    avg_sale = AVG(amount),
+    min_sale = MIN(amount),
+    max_sale = MAX(amount)
+
+// With grouping
+FROM sales
+| STATS 
+    total = SUM(amount),
+    average = AVG(amount)
+  BY product_category
+```
+
+#### MEDIAN, PERCENTILE
+```esql
+FROM response_times
+| STATS 
+    median_time = MEDIAN(duration),
+    p95 = PERCENTILE(duration, 95),
+    p99 = PERCENTILE(duration, 99)
+```
+
+#### Multiple Aggregations
+```esql
+FROM orders
+| STATS 
+    order_count = COUNT(),
+    total_revenue = SUM(amount),
+    avg_order_value = AVG(amount),
+    unique_customers = COUNT_DISTINCT(customer_id)
+  BY region, product_category
+```
+
+---
+
+## String Functions
+
+### CONCAT - Concatenate Strings
+```esql
+FROM employees
+| EVAL full_name = CONCAT(first_name, " ", last_name)
+
+// With separator
+FROM logs-*
+| EVAL log_info = CONCAT(level, ": ", message)
+```
+
+### SUBSTRING - Extract Substring
+```esql
+FROM employees
+| EVAL first_initial = SUBSTRING(first_name, 0, 1)
+
+// Extract with length
+FROM products
+| EVAL short_code = SUBSTRING(product_id, 0, 5)
+```
+
+### LENGTH - String Length
+```esql
+FROM messages
+| EVAL message_length = LENGTH(message)
+| WHERE message_length > 100
+```
+
+### TRIM, LTRIM, RTRIM - Remove Whitespace
+```esql
+FROM user_input
+| EVAL cleaned = TRIM(input_field)
+| EVAL left_trimmed = LTRIM(input_field)
+| EVAL right_trimmed = RTRIM(input_field)
+```
+
+### UPPER, LOWER - Case Conversion
+```esql
+FROM employees
+| EVAL name_upper = UPPER(name)
+| EVAL email_lower = LOWER(email)
+```
+
+### REPLACE - Replace String
+```esql
+FROM logs-*
+| EVAL cleaned_message = REPLACE(message, "ERROR", "Warning")
+```
+
+### SPLIT - Split String into Array
+```esql
+FROM logs-*
+| EVAL tags_array = SPLIT(tags, ",")
+```
+
+### STARTS_WITH, ENDS_WITH
+```esql
+FROM files
+| WHERE STARTS_WITH(filename, "log_")
+| WHERE ENDS_WITH(filename, ".txt")
+```
+
+---
+
+## Mathematical Functions
+
+### Basic Operations
+```esql
+FROM sales
+| EVAL 
+    total = price * quantity,
+    discount_price = price * 0.9,
+    tax = price * 0.08
+
+// Multiple operations
+FROM metrics
+| EVAL 
+    sum_val = field1 + field2,
+    diff_val = field1 - field2,
+    product = field1 * field2,
+    ratio = field1 / field2,
+    remainder = field1 % field2
+```
+
+### ABS - Absolute Value
+```esql
+FROM transactions
+| EVAL abs_amount = ABS(transaction_amount)
+```
+
+### ROUND, FLOOR, CEIL
+```esql
+FROM measurements
+| EVAL 
+    rounded = ROUND(value, 2),
+    floored = FLOOR(value),
+    ceiled = CEIL(value)
+```
+
+### POW - Power
+```esql
+FROM data
+| EVAL squared = POW(value, 2)
+| EVAL cubed = POW(value, 3)
+```
+
+### SQRT - Square Root
+```esql
+FROM measurements
+| EVAL sqrt_value = SQRT(value)
+```
+
+### LOG, LOG10
+```esql
+FROM data
+| EVAL 
+    natural_log = LOG(value),
+    log_base_10 = LOG10(value)
+```
+
+### GREATEST, LEAST
+```esql
+FROM comparisons
+| EVAL 
+    max_val = GREATEST(val1, val2, val3),
+    min_val = LEAST(val1, val2, val3)
+```
+
+---
+
+## Date/Time Functions
+
+### NOW - Current Timestamp
+```esql
+FROM logs-*
+| EVAL current_time = NOW()
+```
+
+### DATE_EXTRACT - Extract Date Parts
+```esql
+FROM events
+| EVAL 
+    year = DATE_EXTRACT("year", @timestamp),
+    month = DATE_EXTRACT("month", @timestamp),
+    day = DATE_EXTRACT("day", @timestamp),
+    hour = DATE_EXTRACT("hour", @timestamp),
+    minute = DATE_EXTRACT("minute", @timestamp),
+    day_of_week = DATE_EXTRACT("day_of_week", @timestamp)
+```
+
+### DATE_FORMAT - Format Date
+```esql
+FROM events
+| EVAL formatted_date = DATE_FORMAT("yyyy-MM-dd", @timestamp)
+| EVAL custom_format = DATE_FORMAT("MMM dd, yyyy HH:mm", @timestamp)
+```
+
+### DATE_TRUNC - Truncate Date
+```esql
+FROM logs-*
+| EVAL 
+    hour_bucket = DATE_TRUNC("hour", @timestamp),
+    day_bucket = DATE_TRUNC("day", @timestamp),
+    month_bucket = DATE_TRUNC("month", @timestamp)
+```
+
+### DATE_DIFF - Date Difference
+```esql
+FROM orders
+| EVAL days_since_order = DATE_DIFF("days", order_date, NOW())
+| EVAL hours_to_delivery = DATE_DIFF("hours", order_date, delivery_date)
+```
+
+### DATE_PARSE - Parse String to Date
+```esql
+FROM data
+| EVAL parsed_date = DATE_PARSE("yyyy-MM-dd", date_string)
+```
+
+---
+
+## Type Conversion Functions
+
+### TO_STRING - Convert to String
+```esql
+FROM data
+| EVAL id_string = TO_STRING(id)
+| EVAL amount_string = TO_STRING(amount)
+```
+
+### TO_INTEGER, TO_LONG - Convert to Integer
+```esql
+FROM data
+| EVAL age_int = TO_INTEGER(age_string)
+| EVAL id_long = TO_LONG(id_string)
+```
+
+### TO_DOUBLE - Convert to Double
+```esql
+FROM data
+| EVAL price_double = TO_DOUBLE(price_string)
+```
+
+### TO_BOOLEAN - Convert to Boolean
+```esql
+FROM data
+| EVAL is_active = TO_BOOLEAN(active_string)
+```
+
+### TO_DATETIME - Convert to DateTime
+```esql
+FROM data
+| EVAL timestamp = TO_DATETIME(date_string)
+```
+
+### TO_IP - Convert to IP Address
+```esql
+FROM logs-*
+| EVAL ip_address = TO_IP(ip_string)
+```
+
+---
+
+## Conditional Functions
+
+### CASE - Conditional Logic
+```esql
+FROM employees
+| EVAL salary_grade = CASE(
+    salary < 50000, "Entry",
+    salary < 80000, "Mid",
+    salary < 120000, "Senior",
+    "Executive"
+  )
+
+// With multiple conditions
+FROM orders
+| EVAL order_status = CASE(
+    status == "pending" AND days_old > 7, "Overdue",
+    status == "pending", "Processing",
+    status == "shipped", "In Transit",
+    status == "delivered", "Completed",
+    "Unknown"
+  )
+```
+
+### COALESCE - Return First Non-Null Value
+```esql
+FROM data
+| EVAL display_name = COALESCE(nickname, first_name, username, "Unknown")
+```
+
+### IF - Simple Conditional
+```esql
+FROM products
+| EVAL stock_status = 
+    CASE(stock > 0, "Available", "Out of Stock")
+
+// Nested conditions
+FROM employees
+| EVAL bonus = CASE(
+    performance_rating >= 4.5, salary * 0.15,
+    performance_rating >= 3.5, salary * 0.10,
+    performance_rating >= 2.5, salary * 0.05,
+    0
+  )
+```
+
+---
+
+## Array Functions
+
+### MV_COUNT - Count Array Elements
+```esql
+FROM logs-*
+| EVAL tag_count = MV_COUNT(tags)
+| WHERE tag_count > 3
+```
+
+### MV_AVG, MV_SUM, MV_MIN, MV_MAX - Array Aggregations
+```esql
+FROM metrics
+| EVAL 
+    avg_value = MV_AVG(values),
+    total = MV_SUM(values),
+    min_value = MV_MIN(values),
+    max_value = MV_MAX(values)
+```
+
+### MV_CONCAT - Concatenate Array Elements
+```esql
+FROM logs-*
+| EVAL all_tags = MV_CONCAT(tags, ", ")
+```
+
+### MV_DEDUPE - Remove Duplicates from Array
+```esql
+FROM data
+| EVAL unique_values = MV_DEDUPE(values)
+```
+
+### MV_FIRST, MV_LAST - Get First/Last Element
+```esql
+FROM logs-*
+| EVAL first_tag = MV_FIRST(tags)
+| EVAL last_tag = MV_LAST(tags)
+```
+
+### MV_SLICE - Extract Array Slice
+```esql
+FROM data
+| EVAL first_three = MV_SLICE(values, 0, 3)
+```
+
+---
+
+## Join Operations (LOOKUP)
+
+ES|QL uses ENRICH (similar to LOOKUP/JOIN) to join data from enrich policies.
+
+### Prerequisites: Create Enrich Policy
+First, create an enrich policy in Kibana Dev Tools:
+
+```json
+PUT /_enrich/policy/user_lookup
+{
+  "match": {
+    "indices": "users",
+    "match_field": "user_id",
+    "enrich_fields": ["username", "email", "department"]
+  }
+}
+
+POST /_enrich/policy/user_lookup/_execute
+```
+
+### ENRICH - Join/Lookup Data
+```esql
+FROM logs-*
+| ENRICH user_lookup ON user_id
+| KEEP @timestamp, user_id, username, email, message
+
+// With field renaming
+FROM transactions
+| ENRICH product_lookup ON product_id WITH product_name, category, price
+| KEEP transaction_id, product_name, category, quantity, price
+
+// Multiple enrichments
+FROM orders
+| ENRICH customer_lookup ON customer_id WITH customer_name, customer_tier
+| ENRICH product_lookup ON product_id WITH product_name, product_category
+| KEEP order_id, customer_name, product_name, order_amount
+```
+
+### Complex Join Example
+```esql
+FROM orders
+| ENRICH customer_lookup ON customer_id 
+    WITH customer_name, customer_email, customer_segment
+| ENRICH product_lookup ON product_id 
+    WITH product_name, product_category, product_price
+| EVAL total_price = quantity * product_price
+| WHERE customer_segment == "Premium"
+| STATS 
+    total_orders = COUNT(),
+    total_revenue = SUM(total_price)
+  BY customer_name, product_category
+| SORT total_revenue DESC
+```
+
+---
+
+## Sorting & Limiting
+
+### SORT - Order Results
+```esql
+// Ascending order (default)
+FROM employees
+| SORT salary
+
+// Descending order
+FROM employees
+| SORT salary DESC
+
+// Multiple fields
+FROM employees
+| SORT department ASC, salary DESC
+
+// With nulls first/last
+FROM data
+| SORT value DESC NULLS FIRST
+```
+
+### LIMIT - Limit Results
+```esql
+// Get first 10 rows
+FROM logs-*
+| LIMIT 10
+
+// Top 5 highest salaries
+FROM employees
+| SORT salary DESC
+| LIMIT 5
+
+// Pagination (skip and limit)
+FROM products
+| SORT price
+| LIMIT 20  // Results 0-19
+```
+
+### HEAD - Get First N Rows (Alias for LIMIT)
+```esql
+FROM logs-*
+| HEAD 100
+```
+
+---
+
+## Grouping & Aggregating
+
+### GROUP BY with STATS
+```esql
+// Single field grouping
+FROM sales
+| STATS total_sales = SUM(amount) BY region
+
+// Multiple field grouping
+FROM orders
+| STATS 
+    order_count = COUNT(),
+    total_revenue = SUM(amount)
+  BY region, product_category, sales_rep
+
+// Time-based grouping
+FROM logs-*
+| EVAL hour = DATE_TRUNC("hour", @timestamp)
+| STATS event_count = COUNT() BY hour, log_level
+| SORT hour DESC
+```
+
+### Complex Aggregation Example
+```esql
+FROM sales_data
+| WHERE order_date >= "2024-01-01"
+| EVAL month = DATE_TRUNC("month", order_date)
+| STATS 
+    total_orders = COUNT(),
+    total_revenue = SUM(amount),
+    avg_order_value = AVG(amount),
+    unique_customers = COUNT_DISTINCT(customer_id),
+    max_order = MAX(amount),
+    min_order = MIN(amount)
+  BY month, region, product_category
+| EVAL revenue_per_customer = total_revenue / unique_customers
+| WHERE total_orders > 100
+| SORT month DESC, total_revenue DESC
+| LIMIT 50
+```
+
+---
+
+## Advanced Patterns
+
+### Window Functions Pattern
+```esql
+// Running total by group
+FROM sales
+| SORT date
+| STATS 
+    daily_sales = SUM(amount),
+    order_count = COUNT()
+  BY date, region
+| SORT region, date
+```
+
+### Pivoting Data
+```esql
+// Count by status and priority
+FROM tickets
+| STATS ticket_count = COUNT() BY status, priority
+| SORT status, priority
+```
+
+### Finding Duplicates
+```esql
+FROM users
+| STATS count = COUNT() BY email
+| WHERE count > 1
+| SORT count DESC
+```
+
+### Time Series Analysis
+```esql
+FROM metrics-*
+| EVAL 
+    hour = DATE_TRUNC("hour", @timestamp),
+    day = DATE_EXTRACT("day", @timestamp)
+| STATS 
+    avg_cpu = AVG(cpu_percent),
+    max_cpu = MAX(cpu_percent),
+    avg_memory = AVG(memory_percent)
+  BY hour, host
+| WHERE avg_cpu > 80
+| SORT hour DESC
+```
+
+### Percentage Calculations
+```esql
+FROM sales
+| STATS 
+    total_sales = SUM(amount),
+    count = COUNT()
+  BY product_category
+| EVAL percentage = ROUND(total_sales / SUM(total_sales) * 100, 2)
+| SORT percentage DESC
+```
+
+### Top N per Group
+```esql
+// Top 3 products per category by sales
+FROM sales
+| STATS total_sales = SUM(amount) BY product_category, product_name
+| SORT product_category, total_sales DESC
+// Note: ES|QL doesn't have native PARTITION BY, 
+// so you may need to process this in multiple queries or use aggregations
+```
+
+### Data Cleaning
+```esql
+FROM raw_data
+| EVAL 
+    // Clean whitespace
+    cleaned_name = TRIM(name),
+    // Standardize case
+    email_lower = LOWER(email),
+    // Replace values
+    status = REPLACE(status, "N/A", "Unknown"),
+    // Handle nulls
+    age = COALESCE(age, 0),
+    // Validate ranges
+    valid_age = CASE(age < 0 OR age > 150, NULL, age)
+| WHERE cleaned_name IS NOT NULL
+| DROP name, email
+| RENAME cleaned_name AS name, email_lower AS email
+```
+
+### Cohort Analysis
+```esql
+FROM user_events
+| EVAL 
+    signup_month = DATE_TRUNC("month", signup_date),
+    event_month = DATE_TRUNC("month", event_date)
+| STATS 
+    active_users = COUNT_DISTINCT(user_id)
+  BY signup_month, event_month
+| SORT signup_month, event_month
+```
+
+### Anomaly Detection Pattern
+```esql
+FROM metrics-*
+| EVAL hour = DATE_TRUNC("hour", @timestamp)
+| STATS 
+    avg_value = AVG(value),
+    stddev = SQRT(AVG(POW(value - AVG(value), 2)))
+  BY hour
+| EVAL 
+    upper_bound = avg_value + (2 * stddev),
+    lower_bound = avg_value - (2 * stddev)
+```
+
+---
+
+## Complete Real-World Examples
+
+### Example 1: User Activity Dashboard
+```esql
+FROM user_logs-*
+| WHERE @timestamp >= NOW() - 7 days
+| ENRICH user_lookup ON user_id WITH username, user_tier
+| EVAL day = DATE_TRUNC("day", @timestamp)
+| STATS 
+    daily_active_users = COUNT_DISTINCT(user_id),
+    total_sessions = COUNT(),
+    avg_session_duration = AVG(session_duration)
+  BY day, user_tier
+| EVAL avg_duration_minutes = ROUND(avg_session_duration / 60, 2)
+| SORT day DESC, user_tier
+```
+
+### Example 2: E-commerce Sales Report
+```esql
+FROM orders
+| WHERE order_date >= "2024-01-01"
+| ENRICH customer_lookup ON customer_id 
+    WITH customer_name, customer_segment
+| ENRICH product_lookup ON product_id 
+    WITH product_name, product_category, cost_price
+| EVAL 
+    profit = (price - cost_price) * quantity,
+    month = DATE_TRUNC("month", order_date)
+| STATS 
+    total_orders = COUNT(),
+    total_revenue = SUM(price * quantity),
+    total_profit = SUM(profit),
+    avg_order_value = AVG(price * quantity),
+    unique_customers = COUNT_DISTINCT(customer_id)
+  BY month, product_category, customer_segment
+| EVAL profit_margin = ROUND(total_profit / total_revenue * 100, 2)
+| WHERE total_revenue > 10000
+| SORT month DESC, total_revenue DESC
+| LIMIT 100
+```
+
+### Example 3: Security Log Analysis
+```esql
+FROM security-logs-*
+| WHERE @timestamp >= NOW() - 24 hours
+| WHERE event_type IN ("login_failed", "suspicious_activity")
+| EVAL hour = DATE_TRUNC("hour", @timestamp)
+| STATS 
+    event_count = COUNT(),
+    unique_ips = COUNT_DISTINCT(source_ip),
+    unique_users = COUNT_DISTINCT(username)
+  BY hour, event_type, country
+| WHERE event_count > 100
+| SORT hour DESC, event_count DESC
+```
+
+### Example 4: Application Performance Monitoring
+```esql
+FROM apm-*
+| WHERE @timestamp >= NOW() - 1 hour
+| EVAL 
+    response_category = CASE(
+        response_time < 100, "Fast",
+        response_time < 500, "Medium",
+        response_time < 1000, "Slow",
+        "Very Slow"
+    ),
+    minute = DATE_TRUNC("minute", @timestamp)
+| STATS 
+    request_count = COUNT(),
+    avg_response = AVG(response_time),
+    p95_response = PERCENTILE(response_time, 95),
+    p99_response = PERCENTILE(response_time, 99),
+    error_count = COUNT() WHERE status_code >= 400
+  BY minute, endpoint, response_category
+| EVAL error_rate = ROUND(error_count / request_count * 100, 2)
+| WHERE request_count > 10
+| SORT minute DESC, avg_response DESC
+```
+
+---
+
+## Tips & Best Practices
+
+1. **Use KEEP instead of SELECT** - More explicit about which fields to retain
+2. **Filter early with WHERE** - Reduce data processing by filtering before aggregations
+3. **Use DATE_TRUNC for time bucketing** - Essential for time series analysis
+4. **Leverage ENRICH for joins** - Pre-create enrich policies for frequently joined data
+5. **Use EVAL for calculated fields** - Create derived fields before aggregation
+6. **Combine multiple conditions in WHERE** - More efficient than multiple WHERE clauses
+7. **Use STATS with BY for grouping** - Replaces traditional GROUP BY
+8. **Sort after aggregation** - More efficient than sorting before
+9. **Use LIMIT to control output size** - Especially important for large datasets
+10. **Use metadata fields when needed** - Access _id, _index with METADATA keyword
+
+---
+
+## Common Patterns Cheat Sheet
+
+```esql
+// Count by field
+FROM index | STATS count = COUNT() BY field
+
+// Top N
+FROM index | STATS value = SUM(amount) BY category | SORT value DESC | LIMIT 10
+
+// Time series
+FROM index | EVAL bucket = DATE_TRUNC("hour", @timestamp) | STATS count = COUNT() BY bucket
+
+// Percentage of total
+FROM index | STATS total = SUM(amount) BY category | EVAL pct = total / SUM(total) * 100
+
+// Filter nulls
+FROM index | WHERE field IS NOT NULL
+
+// String matching
+FROM index | WHERE field LIKE "*pattern*"
+
+// Date range
+FROM index | WHERE @timestamp >= NOW() - 7 days
+
+// Multiple aggregations
+FROM index | STATS count = COUNT(), sum = SUM(val), avg = AVG(val) BY group
+
+// Conditional aggregation
+FROM index | STATS error_count = COUNT() WHERE status == "error" BY service
+```
+
+---
+
+## Comparison with Traditional SQL
+
+| SQL | ES|QL |
+|-----|-------|
+| SELECT * | FROM index |
+| SELECT field1, field2 | FROM index \| KEEP field1, field2 |
+| WHERE condition | WHERE condition (same) |
+| GROUP BY field | STATS ... BY field |
+| ORDER BY field | SORT field |
+| LIMIT 10 | LIMIT 10 (same) |
+| COUNT(*) | STATS count = COUNT() |
+| SUM(field) | STATS total = SUM(field) |
+| AVG(field) | STATS avg = AVG(field) |
+| JOIN | ENRICH (using enrich policies) |
+| CASE WHEN | CASE(...) |
+| CONCAT(a, b) | CONCAT(a, b) (same) |
+
+---
+
+## Resources
+
+- Official ES|QL Documentation: https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html
+- ES|QL Functions Reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/esql-functions.html
+- Enrich Processor: https://www.elastic.co/guide/en/elasticsearch/reference/current/enrich-processor.html
+
+---
+
+*Last Updated: 2024*
+*ES|QL is actively evolving - check official documentation for latest features*
--- a/cmd/api.go
+++ b/cmd/api.go
@@ -28,7 +28,7 @@ import (
 func Api(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "api",
-		Usage: "manage apiuments",
+		Usage: "api access and documentation",

 		Commands: []*cli.Command{
 			ApiList(conf),
@@ -72,7 +72,7 @@ func ApiShow(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Capi)
+			complete(conf, cmd, Capi)
 		},
 	}
 }
@@ -83,6 +83,22 @@ func ApiRepl(conf *cfg.Config) *cli.Command {
 		Aliases: []string{"shell"},
 		Usage:   "interactive API repl",

+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "pager",
+				Usage:       "external viewer program (default:internal)",
+				Destination: &conf.Pager,
+				Aliases:     []string{"p"},
+				Sources:     cli.EnvVars("PAGER", "ES_JSON_PAGER"),
+			},
+			&cli.BoolFlag{
+				Name:        "human-readable-cat",
+				Usage:       "enable human readable /_cat output",
+				Destination: &conf.HumanCat,
+				Aliases:     []string{"H"},
+			},
+		},
+
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			return es.ApiRepl(conf)
 		},
--- a/cmd/ccr.go
+++ b/cmd/ccr.go
@@ -59,7 +59,7 @@ func CcrStatus(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Ccluster)
+			complete(conf, cmd, Ccluster)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -115,7 +115,7 @@ func CcrRemoteInfo(conf *cfg.Config) *cli.Command {
 		UsageText: "info [options] [<index>]",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/ccr_follower.go
+++ b/cmd/ccr_follower.go
@@ -60,7 +60,7 @@ func CcrFollowerRenew(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -82,7 +82,7 @@ func CcrFollowerResume(conf *cfg.Config) *cli.Command {
 		UsageText: "resume [options] <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -104,7 +104,7 @@ func CcrFollowerPause(conf *cfg.Config) *cli.Command {
 		UsageText: "pause [options] <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -126,7 +126,7 @@ func CcrFollowerUnfollow(conf *cfg.Config) *cli.Command {
 		UsageText: "unfollow [options] <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -158,7 +158,7 @@ func CcrFollowerAdd(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -181,7 +181,7 @@ func CcrFollowerDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -205,7 +205,7 @@ func CcrFollowerShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/cluster.go
+++ b/cmd/cluster.go
@@ -18,6 +18,7 @@ package cmd

 import (
 	"context"
+	"errors"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -33,8 +34,10 @@ func Cluster(conf *cfg.Config) *cli.Command {

 		Commands: []*cli.Command{
 			ClusterStatus(conf),
+			ClusterSwitch(conf),
 			ClusterList(conf),
 			ClusterSettings(conf),
+			ClusterReroute(conf),
 		},
 	}
 }
@@ -58,12 +61,6 @@ func ClusterStatus(conf *cfg.Config) *cli.Command {
 		Aliases: []string{"s"},

 		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name:        "all",
-				Usage:       "show status of all clusters",
-				Destination: &conf.All,
-				Aliases:     []string{"a"},
-			},
 			&cli.BoolFlag{
 				Name:        "verbose",
 				Usage:       "include verbose statistics",
@@ -77,3 +74,25 @@ func ClusterStatus(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func ClusterSwitch(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "switch",
+		Usage:     "set current elasticsearch cluster",
+		UsageText: "switch <cluster-name>",
+		Aliases:   []string{"ctx"},
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Ccluster)
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			name := cmd.Args().Get(0)
+			if name == "" {
+				return errors.New("no cluster name specified")
+			}
+
+			return conf.SwitchCluster(name)
+		},
+	}
+}
--- a/cmd/cluster_reroute.go
+++ b/cmd/cluster_reroute.go
@@ -0,0 +1,224 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cmd
+
+import (
+	"context"
+	"errors"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
+
+	"github.com/urfave/cli/v3"
+)
+
+func ClusterReroute(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "reroute",
+		Usage:     "manually change the allocation of individual shards in the cluster.",
+		UsageText: "reroute <cluster-name>",
+		Aliases:   []string{"ctx"},
+
+		Commands: []*cli.Command{
+			ClusterRerouteMove(conf),
+			ClusterRerouteAllocateReplica(conf),
+			ClusterRerouteCancel(conf),
+			ClusterRerouteAllocatePrimary(conf, false),
+			ClusterRerouteAllocatePrimary(conf, true),
+		},
+	}
+}
+
+func ClusterRerouteMove(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "move",
+		Usage:     "move shard to another node",
+		UsageText: "move [options] <index>",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cindex)
+		},
+
+		Flags: []cli.Flag{
+			&cli.IntFlag{
+				Name:        "shard",
+				Usage:       "shard to move",
+				Destination: &conf.Shards,
+				Aliases:     []string{"s"},
+				Required:    true,
+			},
+			&cli.StringFlag{
+				Name:        "from-node",
+				Usage:       "current node",
+				Destination: &conf.FromNode,
+				Aliases:     []string{"f"},
+				Required:    true,
+			},
+			&cli.StringFlag{
+				Name:        "to-node",
+				Usage:       "node to move to",
+				Destination: &conf.ToNode,
+				Aliases:     []string{"t"},
+				Required:    true,
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.ClusterRerouteMove(conf, index)
+		},
+	}
+}
+
+func ClusterRerouteAllocateReplica(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "allocate-replica",
+		Usage:     "allocate-replica replica to another node",
+		UsageText: "allocate-replica [options] <index>",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cindex)
+		},
+
+		Flags: []cli.Flag{
+			&cli.IntFlag{
+				Name:        "shard",
+				Usage:       "shard to move",
+				Destination: &conf.Shards,
+				Aliases:     []string{"s"},
+				Required:    true,
+			},
+			&cli.StringFlag{
+				Name:        "to-node",
+				Usage:       "node to move to",
+				Destination: &conf.ToNode,
+				Aliases:     []string{"t"},
+				Required:    true,
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.ClusterRerouteAllocateReplica(conf, index)
+		},
+	}
+}
+
+func ClusterRerouteCancel(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "cancel",
+		Usage:     "cancel a reroute operation",
+		UsageText: "cancel [options] <index>",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cindex)
+		},
+
+		Flags: []cli.Flag{
+			&cli.IntFlag{
+				Name:        "shard",
+				Usage:       "shard to move",
+				Destination: &conf.Shards,
+				Aliases:     []string{"s"},
+				Required:    true,
+			},
+			&cli.StringFlag{
+				Name:        "to-node",
+				Usage:       "node to move to",
+				Destination: &conf.ToNode,
+				Aliases:     []string{"t"},
+				Required:    true,
+			},
+			&cli.BoolFlag{
+				Name:        "allow-primary",
+				Usage:       "allow primary shard to cancel",
+				Destination: &conf.AllowPrimary,
+				Aliases:     []string{"a"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.ClusterRerouteCancel(conf, index)
+		},
+	}
+}
+
+func ClusterRerouteAllocatePrimary(conf *cfg.Config, stale bool) *cli.Command {
+	name := "allocate-empty-primary"
+	usage := "allocate an empty primary shard to a node"
+
+	if stale {
+		name = "allocate-stale-primary"
+		usage = "allocate a stale primary shard to a node"
+	}
+
+	return &cli.Command{
+		Name:      name,
+		Usage:     usage,
+		UsageText: name + " [options] <index>",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cindex)
+		},
+
+		Flags: []cli.Flag{
+			&cli.IntFlag{
+				Name:        "shard",
+				Usage:       "shard to move",
+				Destination: &conf.Shards,
+				Aliases:     []string{"s"},
+				Required:    true,
+			},
+			&cli.StringFlag{
+				Name:        "to-node",
+				Usage:       "node to move to",
+				Destination: &conf.ToNode,
+				Aliases:     []string{"t"},
+				Required:    true,
+			},
+			&cli.BoolFlag{
+				Name:        "accept-data-loss",
+				Usage:       "",
+				Destination: &conf.AcceptDataLoss,
+				Aliases:     []string{"a"},
+				Required:    true,
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.ClusterRerouteAllocatePrimary(conf, index, stale)
+		},
+	}
+}
--- a/cmd/cluster_settings.go
+++ b/cmd/cluster_settings.go
@@ -104,6 +104,10 @@ func ClusterSettingsSet(conf *cfg.Config) *cli.Command {
 			},
 		},

+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cclustersettings)
+		},
+
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()

--- a/cmd/completion.go
+++ b/cmd/completion.go
@@ -32,22 +32,19 @@ const (
 	Ccluster
 	Capi
 	Cilm
+	Cnode
+	Cclustersettings
 )

-func complete(cmd *cli.Command, what int) {
+func complete(conf *cfg.Config, cmd *cli.Command, what int) {
 	if cmd.NArg() > 0 {
 		return
 	}

-	// FIXME: config should load from root.Before(), see https://github.com/urfave/cli/issues/2348
-	// workaround: load it directly here
-	conf := cfg.NewConfig()
-	if err := conf.Init(); err != nil {
-		return
-	}
-
-	var list []string
-	var err error
+	var (
+		list []string
+		err  error
+	)

 	switch what {
 	case Cindex:
@@ -64,6 +61,10 @@ func complete(cmd *cli.Command, what int) {
 		list = es.ApiPathNames()
 	case Cilm:
 		list, err = es.IlmNames(conf)
+	case Cnode:
+		list, err = es.NodeNames(conf)
+	case Cclustersettings:
+		list, err = es.ClusterSettingsNames(conf)
 	}

 	if err != nil {
--- a/cmd/datastream.go
+++ b/cmd/datastream.go
@@ -91,7 +91,7 @@ func DatastreamShow(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},
 	}
 }
@@ -113,7 +113,7 @@ func DatastreamCreate(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},
 	}
 }
@@ -135,7 +135,7 @@ func DatastreamDelete(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},
 	}
 }
@@ -148,7 +148,7 @@ func DatastreamRollover(conf *cfg.Config) *cli.Command {
 		UsageText: "rollover <data stream>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Flags: []cli.Flag{
@@ -205,7 +205,7 @@ func DatastreamIlm(conf *cfg.Config) *cli.Command {
 		UsageText: "ds ilm <name>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cdatastream)
+			complete(conf, cmd, Cdatastream)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/ilm.go
+++ b/cmd/ilm.go
@@ -36,7 +36,10 @@ func Ilm(conf *cfg.Config) *cli.Command {
 			IlmStatus(conf),
 			IlmList(conf),
 			IlmShow(conf),
-			IlmCreate(conf),
+			IlmCreate(conf, false),
+			IlmCreate(conf, true),
+			IlmForecast(conf),
+			IlmExplain(conf),
 		},
 	}
 }
@@ -53,6 +56,23 @@ func IlmRetry(conf *cfg.Config) *cli.Command {
 	}
 }

+func IlmExplain(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "explain",
+		Usage:     "explain ilm condition of an index",
+		UsageText: "explain <index>",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.IlmExplain(conf, index)
+		},
+	}
+}
+
 func IlmStatus(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "status",
@@ -84,6 +104,15 @@ func IlmShow(conf *cfg.Config) *cli.Command {
 		Usage:     "show details about an index lifecycle policy",
 		UsageText: "show <policy>",

+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:        "tree",
+				Usage:       "display policy as a tree",
+				Destination: &conf.Ilm.Tree,
+				Aliases:     []string{"t"},
+			},
+		},
+
 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			policy := cmd.Args().Get(0)
 			if policy == "" {
@@ -94,77 +123,27 @@ func IlmShow(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cilm)
+			complete(conf, cmd, Cilm)
 		},
 	}
 }

-/*
- *
-{
-  "policy": {
-    "phases": {
-      "hot": {
-        "min_age": "0ms",
-        "actions": {
-          "rollover": {
-            "max_primary_shard_size": "50gb",
-            "max_age": "1d",
-            "max_docs": 100000000
-          },
-          "set_priority": {
-            "priority": 100
-          }
-        }
-      },
-      "warm": {
-        "min_age": "7d",
-        "actions": {
-          "migrate": {},
-          "shrink": {
-            "number_of_shards": 1
-          },
-          "forcemerge": {
-            "max_num_segments": 1
-          },
-          "set_priority": {
-            "priority": 50
-          }
-        }
-      },
-      "cold": {
-        "min_age": "30d",
-        "actions": {
-          "migrate": {},
-          "searchable_snapshot": {
-            "snapshot_repository": "s3-logs-archive",
-            "force_merge_index": true
-          },
-          "set_priority": {
-            "priority": 0
-          }
-        }
-      },
-      "delete": {
-        "min_age": "90d",
-        "actions": {
-          "delete": {
-            "delete_searchable_snapshot": true
-          }
-        }
-      }
-    }
-  }
-}
+func IlmCreate(conf *cfg.Config, modify bool) *cli.Command {
+	name := "create"
+	alias := "+"
+	usage := "create a new lifecycle policy"

-*/
+	if modify {
+		name = "update"
+		usage = "update an lifecycle policy"
+		alias = "upd"
+	}

-func IlmCreate(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
-		Name:      "create",
-		Aliases:   []string{"+"},
-		Usage:     "create a index lifecycle policy",
-		UsageText: "create [options] <policy>",
+		Name:      name,
+		Aliases:   []string{alias},
+		Usage:     usage,
+		UsageText: name + " [options] <policy>",

 		Flags: []cli.Flag{
 			&cli.StringFlag{
@@ -185,7 +164,7 @@ func IlmCreate(conf *cfg.Config) *cli.Command {
 				Usage:       "hot phase: rollover after",
 				Destination: &conf.Ilm.HotRolloverMaxAge,
 			},
-			&cli.Int64Flag{
+			&cli.StringFlag{
 				Name:        "hot-rollover-max-primary-shard-size",
 				Usage:       "hot phase: max primary shard size",
 				Destination: &conf.Ilm.HotRolloverMaxPrimaryShardSize,
@@ -251,6 +230,11 @@ func IlmCreate(conf *cfg.Config) *cli.Command {
 				Usage:       "frozen phase: min age",
 				Destination: &conf.Ilm.FrozenMinAge,
 			},
+			&cli.StringFlag{
+				Name:        "frozen-searchable-snapshot-repo",
+				Usage:       "frozen phase: searchable snapshot repo",
+				Destination: &conf.Ilm.FrozenSearchableSnapshotRepo,
+			},

 			// delete
 			&cli.StringFlag{
--- a/cmd/ilm_forecast.go
+++ b/cmd/ilm_forecast.go
@@ -0,0 +1,139 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cmd
+
+import (
+	"context"
+	"errors"
+	"slices"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
+
+	"github.com/urfave/cli/v3"
+)
+
+func IlmForecast(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "forecast",
+		Usage: "calculate index phase movements",
+
+		Commands: []*cli.Command{
+			IlmForecastList(conf),
+			IlmForecastShow(conf),
+		},
+	}
+}
+
+const IlmForeCastListReference = `<duration> must be a string which consists one or more of these elements:
+d - days
+h - hours
+m - minutes
+s - seconds
+
+Examples:
+
+58d12h  - 58 days and 12 hours
+122h30m - 122 hours and 30 minutes
+
+Specs may be mixed:
+
+8h12d   - 12 days and 8 hours`
+
+func IlmForecastList(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:               "list",
+		Aliases:            []string{"ls"},
+		Usage:              "list index rollover config",
+		UsageText:          "list [options] [<filter>]",
+		CustomHelpTemplate: addReference(IlmForeCastListReference),
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "from-phase",
+				Usage:       "which ilm phase to forecast from",
+				Destination: &conf.Ilm.FromPhase,
+				Aliases:     []string{"f"},
+			},
+			&cli.StringFlag{
+				Name:        "within",
+				Usage:       "<duration> within which to forecast",
+				Destination: &conf.Ilm.Within,
+				Aliases:     []string{"w"},
+			},
+			&cli.StringFlag{
+				Name:        "min-age",
+				Usage:       "show only indices older than <duration>",
+				Destination: &conf.Ilm.MinAge,
+				Aliases:     []string{"m"},
+			},
+			&cli.BoolFlag{
+				Name:        "verbose",
+				Usage:       "show ilm policy as well",
+				Destination: &conf.Verbose,
+				Aliases:     []string{"v"},
+			},
+			&cli.BoolFlag{
+				Name:        "hidden",
+				Usage:       "include hidden indicies",
+				Destination: &conf.Hidden,
+				Aliases:     []string{"H"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			valid := []string{"hot", "warm", "cold", "frozen"}
+			if !slices.Contains(valid, conf.Ilm.FromPhase) {
+				return errors.New("invalid from phase, allowed: hot, warm, cold, frozen")
+			}
+
+			return es.IlmForecastList(conf, cmd.Args().Get(0))
+		},
+	}
+}
+
+func IlmForecastShow(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:    "show",
+		Aliases: []string{"sh"},
+		Usage:   "show rollover forecast over all indices",
+
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:        "from-phase",
+				Usage:       "which ilm phase to forecast from",
+				Destination: &conf.Ilm.FromPhase,
+				Aliases:     []string{"f"},
+			},
+			&cli.StringFlag{
+				Name:        "within",
+				Usage:       "duration within which to forecast",
+				Destination: &conf.Ilm.Within,
+				Aliases:     []string{"w"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			valid := []string{"hot", "warm", "cold", "frozen"}
+			if !slices.Contains(valid, conf.Ilm.FromPhase) {
+				return errors.New("invalid from phase, allowed: hot, warm, cold, frozen")
+			}
+
+			return es.IlmForecastShow(conf)
+		},
+	}
+}
--- a/cmd/index.go
+++ b/cmd/index.go
@@ -19,7 +19,6 @@ package cmd
 import (
 	"context"
 	"errors"
-	"fmt"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -36,13 +35,13 @@ func Index(conf *cfg.Config) *cli.Command {
 		Commands: []*cli.Command{
 			IndexList(conf),
 			IndexShow(conf),
-			IndexCreate(conf),
+			IndexCreate(conf, false),
+			IndexCreate(conf, true),
 			IndexDelete(conf),
 			IndexClose(conf),
-			IndexAllocation(conf),
-			IndexModify(conf),
 			IndexFields(conf),
 			IndexIlm(conf),
+			IndexDu(conf),

 			// sub commands
 			IndexAlias(conf),
@@ -71,10 +70,16 @@ func IndexList(conf *cfg.Config) *cli.Command {
 				Aliases:     []string{"p"},
 			},
 			&cli.BoolFlag{
-				Name:        "reds",
+				Name:        "hidden",
+				Usage:       "include hidden indicies",
+				Destination: &conf.Hidden,
+				Aliases:     []string{"H"},
+			},
+			&cli.BoolFlag{
+				Name:        "failed",
 				Usage:       "include only red failed indicies",
 				Destination: &conf.Failed,
-				Aliases:     []string{"r"},
+				Aliases:     []string{"f"},
 			},
 			&cli.StringSliceFlag{
 				Name:        "filter",
@@ -90,38 +95,6 @@ func IndexList(conf *cfg.Config) *cli.Command {
 	}
 }

-func IndexAllocation(conf *cfg.Config) *cli.Command {
-	return &cli.Command{
-		Name:    "allocation",
-		Aliases: []string{"a"},
-		Usage:   "explain index allocation",
-
-		Flags: []cli.Flag{
-			&cli.IntFlag{
-				Name:        "shard",
-				Usage:       "shard number to explain for",
-				Destination: &conf.Shards,
-				Aliases:     []string{"s"},
-			},
-			&cli.BoolFlag{
-				Name:        "primary",
-				Usage:       "explain primary allocation (default true)",
-				Destination: &conf.Primary,
-				Aliases:     []string{"p"},
-			},
-		},
-
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			index := cmd.Args().Get(0)
-			if index == "" {
-				return errors.New("no index specified")
-			}
-
-			return es.IndexAllocation(conf, cmd.Args().Get(0))
-		},
-	}
-}
-
 func IndexShow(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:    "show",
@@ -138,17 +111,25 @@ func IndexShow(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 	}
 }

-func IndexCreate(conf *cfg.Config) *cli.Command {
+func IndexCreate(conf *cfg.Config, modify bool) *cli.Command {
+	name := "create"
+	usage := "create a new index"
+
+	if modify {
+		name = "update"
+		usage = "update an index"
+	}
+
 	return &cli.Command{
-		Name:    "create",
+		Name:    name,
 		Aliases: []string{"+"},
-		Usage:   "create a new index",
-		UsageText: `create <name> <fieldmapping:type>...
+		Usage:   usage,
+		UsageText: name + ` <name> <fieldmapping:type>...
 Valid field mapping types: integer, text, date, keyword`,

 		Flags: []cli.Flag{
@@ -171,12 +152,18 @@ Valid field mapping types: integer, text, date, keyword`,
 				Aliases:     []string{"r"},
 				Value:       1,
 			},
+			&cli.StringFlag{
+				Name:        "ilm-policy",
+				Usage:       "ilm policy to apply",
+				Destination: &conf.Policy,
+				Aliases:     []string{"p"},
+			},
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()
 			if args.Len() == 0 {
-				return fmt.Errorf("no index specified")
+				return errors.New("no index specified")
 			}

 			mappings := args.Slice()[1:]
@@ -194,7 +181,7 @@ func IndexDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -215,7 +202,7 @@ func IndexClose(conf *cfg.Config) *cli.Command {
 		UsageText: "close <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -229,37 +216,6 @@ func IndexClose(conf *cfg.Config) *cli.Command {
 	}
 }

-func IndexModify(conf *cfg.Config) *cli.Command {
-	return &cli.Command{
-		Name:      "modify",
-		Usage:     "modify an index",
-		UsageText: "modify <index[,index,...]|_all>",
-
-		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
-		},
-
-		Flags: []cli.Flag{
-			&cli.IntFlag{
-				Name:        "replicas",
-				Usage:       "number of replicas",
-				Destination: &conf.Replicas,
-				Aliases:     []string{"r"},
-				Value:       1,
-			},
-		},
-
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			index := cmd.Args().Get(0)
-			if index == "" {
-				return errors.New("no index specified")
-			}
-
-			return es.IndexModify(conf, index)
-		},
-	}
-}
-
 func IndexFields(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "fields",
@@ -288,7 +244,7 @@ func IndexFields(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -309,7 +265,7 @@ func IndexIlm(conf *cfg.Config) *cli.Command {
 		UsageText: "index ilm <index>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -322,3 +278,24 @@ func IndexIlm(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func IndexDu(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "du",
+		Usage:     "show index disk usage",
+		UsageText: "index du <index>",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cindex)
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.IndexDiskusage(conf, index)
+		},
+	}
+}
--- a/cmd/index_alias.go
+++ b/cmd/index_alias.go
@@ -38,7 +38,8 @@ func IndexAlias(conf *cfg.Config) *cli.Command {
 			IndexAliasDelete(conf),
 			IndexAliasRollover(conf),
 			// FIXME: implement IndexAliasAdd
-			//IndexAliasAdd(conf), // see https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-update-aliases
+			// see https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-update-aliases
+			// IndexAliasAdd(conf),
 		},
 	}
 }
@@ -51,7 +52,7 @@ func IndexAliasCreate(conf *cfg.Config) *cli.Command {
 		UsageText: "create <index> <alias>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -75,7 +76,7 @@ func IndexAliasDelete(conf *cfg.Config) *cli.Command {
 		UsageText: "delete <index> <alias>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
@@ -99,7 +100,7 @@ func IndexAliasRollover(conf *cfg.Config) *cli.Command {
 		UsageText: "rollover <alias>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},

 		Flags: []cli.Flag{
--- a/cmd/index_template.go
+++ b/cmd/index_template.go
@@ -19,7 +19,6 @@ package cmd
 import (
 	"context"
 	"errors"
-	"fmt"
 	"slices"

 	"codeberg.org/scip/esctl/pkg/cfg"
@@ -72,7 +71,7 @@ func IndexTemplateShow(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 	}
 }
@@ -83,8 +82,8 @@ func IndexTemplateCreate(conf *cfg.Config, modify bool) *cli.Command {
 	required := true

 	if modify {
-		name = "modify"
-		alias = "mod"
+		name = "update"
+		alias = "upd"
 		required = false
 	}

@@ -169,12 +168,18 @@ https://www.elastic.co/docs/reference/elasticsearch/index-settings
 				Destination: &conf.Aliases,
 				Aliases:     []string{"A"},
 			},
+			&cli.StringFlag{
+				Name:        "ilm-policy",
+				Usage:       "ilm policy to apply",
+				Destination: &conf.Policy,
+				Aliases:     []string{"p"},
+			},
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
 			args := cmd.Args()
 			if args.Len() == 0 {
-				return fmt.Errorf("no name specified")
+				return errors.New("no name specified")
 			}

 			if conf.Mode != "" {
@@ -210,7 +215,7 @@ func IndexTemplateDelete(conf *cfg.Config) *cli.Command {
 		},

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Cindex)
+			complete(conf, cmd, Cindex)
 		},
 	}
 }
--- a/cmd/license.go
+++ b/cmd/license.go
@@ -0,0 +1,49 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cmd
+
+import (
+	"context"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/es"
+
+	"github.com/urfave/cli/v3"
+)
+
+func License(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "license",
+		Usage: "manage cluster license",
+
+		Commands: []*cli.Command{
+			LicenseShow(conf),
+		},
+	}
+}
+
+func LicenseShow(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:    "show",
+		Aliases: []string{"sh"},
+		Usage:   "show details about the cluster license",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return es.LicenseShow(conf)
+		},
+	}
+}
--- a/cmd/node.go
+++ b/cmd/node.go
@@ -18,6 +18,7 @@ package cmd

 import (
 	"context"
+	"errors"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -34,6 +35,8 @@ func Node(conf *cfg.Config) *cli.Command {
 		Commands: []*cli.Command{
 			NodeList(conf),
 			NodeShow(conf),
+			NodeClients(conf),
+			NodeUsage(conf),
 		},
 	}
 }
@@ -57,10 +60,63 @@ func NodeShow(conf *cfg.Config) *cli.Command {
 		Usage:     "show details about a node",
 		UsageText: "show [options] <node>",

+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cnode)
+		},
+
 		Action: func(ctx context.Context, cmd *cli.Command) error {
-			// FIXME: implement es.NodeShow()
-			// return es.NodeShow(conf, cmd.Args().Get(0))
-			return nil
+			node := cmd.Args().Get(0)
+			if node == "" {
+				return errors.New("no node specified")
+			}
+
+			return es.NodeShow(conf, node)
+		},
+	}
+}
+
+func NodeClients(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "clients",
+		Usage:     "show node http clients",
+		UsageText: "clients [options] <node>",
+
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:        "query",
+				Usage:       "include query parameters",
+				Destination: &conf.All,
+				Aliases:     []string{"q"},
+			},
+		},
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cnode)
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			node := cmd.Args().Get(0)
+			if node == "" {
+				return errors.New("no node specified")
+			}
+
+			return es.NodeClients(conf, node)
+		},
+	}
+}
+
+func NodeUsage(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "usage",
+		Usage:     "show node usage stats",
+		UsageText: "usage [options] [<node>]",
+
+		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
+			complete(conf, cmd, Cnode)
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			return es.NodeUsage(conf, cmd.Args().Get(0))
 		},
 	}
 }
--- a/cmd/roles.go
+++ b/cmd/roles.go
@@ -68,7 +68,7 @@ func RoleShow(conf *cfg.Config) *cli.Command {
 		UsageText: "show [options] <role>",

 		ShellComplete: func(ctx context.Context, cmd *cli.Command) {
-			complete(cmd, Crole)
+			complete(conf, cmd, Crole)
 		},

 		Action: func(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -22,137 +22,28 @@ import (
 	golog "log"
 	"os"
 	"runtime/pprof"
+	"strings"

+	"codeberg.org/scip/esctl/assets"
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
 	"codeberg.org/scip/esctl/pkg/log"
+	"codeberg.org/scip/esctl/pkg/printer"

+	markdown "github.com/MichaelMure/go-term-markdown"
 	"github.com/urfave/cli/v3"
 )

-func Finish(err error) int {
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "Error: ", err.Error())
-		return 1
-	}
+const (
+	versionFmt = `esctl version: %s
+  build: %s
+  branch: %s
+  commit: %s
+  go version: %s
+  API Version: %s
+`

-	return 0
-}
-
-func Main() int {
-	conf := cfg.NewConfig()
-
-	cmd := &cli.Command{
-		Name:  "esctl",
-		Usage: "manage elasticsearch from cli",
-		//Version:               cfg.Version,
-		EnableShellCompletion: true,
-
-		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name:        "debug",
-				Aliases:     []string{"d"},
-				Value:       false,
-				Usage:       "enable debugging",
-				Sources:     cli.EnvVars("ES_DEBUG"),
-				Destination: &conf.Debug,
-			},
-			&cli.BoolFlag{
-				Name:        "debug-http",
-				Value:       false,
-				Usage:       "enable HTTP debugging",
-				Destination: &conf.DebugHTTP,
-			},
-			&cli.StringFlag{
-				Name:        "config",
-				Aliases:     []string{"c"},
-				Value:       "",
-				Usage:       "config file",
-				Sources:     cli.EnvVars("ES_CONFIG"),
-				Destination: &conf.ConfigFile,
-			},
-			&cli.StringFlag{
-				Name:        "cluster",
-				Aliases:     []string{"C"},
-				Value:       "",
-				Usage:       "cluster alias to work with",
-				Destination: &conf.CurrentCluster,
-			},
-			&cli.StringFlag{
-				Name:        "output",
-				Aliases:     []string{"o"},
-				Value:       "",
-				Usage:       "output mode (tsv, markdown, json, yaml) default: tsv",
-				Destination: &conf.Output,
-			},
-			&cli.StringFlag{
-				Name:        "profile-file",
-				Usage:       "golang profiler output file",
-				Destination: &conf.ProfileFile,
-				Hidden:      true,
-			},
-		},
-
-		Commands: []*cli.Command{
-			Search(conf),
-			Cluster(conf),
-			Ccr(conf),
-			Index(conf),
-			Ilm(conf),
-			Datastream(conf),
-			Shard(conf),
-			Snapshot(conf),
-			Node(conf),
-			Doc(conf),
-			Version(conf),
-			Debug(conf),
-			Roles(conf),
-			Task(conf),
-			HelpJsonPath(conf),
-			Api(conf),
-		},
-
-		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-			if err := conf.Init(); err != nil {
-				if len(os.Args) > 1 {
-					return nil, err
-				} else {
-					fmt.Println(cmd.UsageText)
-					return nil, nil
-				}
-			}
-
-			log.Init(conf)
-
-			if conf.ProfileFile != "" {
-				// enable  cpu profiling. Do  NOT use q  to stop the  game but
-				// close the window to get a profile
-				fd, err := os.Create(conf.ProfileFile)
-				if err != nil {
-					return nil, err
-				}
-				defer func() {
-					if err := fd.Close(); err != nil {
-						golog.Fatal(err)
-					}
-				}()
-
-				if err := pprof.StartCPUProfile(fd); err != nil {
-					golog.Fatal(err)
-				}
-
-				defer pprof.StopCPUProfile()
-			}
-
-			return nil, nil
-		},
-	}
-
-	return Finish(cmd.Run(context.Background(), os.Args))
-}
-
-func HelpJsonPath(conf *cfg.Config) *cli.Command {
-	msg := `jsonPath usage:
+	jsonPathUsage = `jsonPath usage:

 name.last          >> "Anderson"
 age                >> 37
@@ -192,26 +83,179 @@ To extract more than one field, use:


 Documentation: https://github.com/tidwall/gjson/blob/master/SYNTAX.md`
+)

+func Finish(err error) int {
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "Error: ", err.Error())
+
+		return 1
+	}
+
+	return 0
+}
+
+func Main() int {
+	conf := cfg.NewConfig()
+
+	cmd := &cli.Command{
+		Name:                  "esctl",
+		Usage:                 "manage elasticsearch from cli",
+		EnableShellCompletion: true,
+
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:        "debug",
+				Aliases:     []string{"d"},
+				Value:       false,
+				Usage:       "enable debugging",
+				Sources:     cli.EnvVars("ES_DEBUG"),
+				Destination: &conf.Debug,
+			},
+			&cli.BoolFlag{
+				Name:        "debug-http",
+				Value:       false,
+				Usage:       "enable HTTP debugging",
+				Destination: &conf.DebugHTTP,
+			},
+			&cli.BoolFlag{
+				Name:        "align-ints",
+				Aliases:     []string{"I"},
+				Value:       false,
+				Usage:       "right align integers in tabular output",
+				Destination: &conf.AlignInts,
+			},
+			&cli.StringFlag{
+				Name:        "config",
+				Aliases:     []string{"c"},
+				Value:       "",
+				Usage:       "config file",
+				Sources:     cli.EnvVars("ES_CONFIG"),
+				Destination: &conf.ConfigFile,
+			},
+			&cli.StringFlag{
+				Name:        "cluster",
+				Aliases:     []string{"C"},
+				Value:       "",
+				Usage:       "cluster alias to work with",
+				Destination: &conf.CurrentCluster,
+			},
+			&cli.StringFlag{
+				Name:        "output",
+				Aliases:     []string{"o"},
+				Value:       "",
+				Usage:       "output mode (tsv, csv, json, yaml) default: tsv",
+				Destination: &conf.Output,
+			},
+			&cli.StringFlag{
+				Name:        "profile-file",
+				Usage:       "golang profiler output file",
+				Destination: &conf.ProfileFile,
+				Hidden:      true,
+			},
+		},
+
+		Commands: []*cli.Command{
+			Api(conf),
+			Ccr(conf),
+			Cluster(conf),
+			Datastream(conf),
+			Doc(conf),
+			Ilm(conf),
+			Index(conf),
+			License(conf),
+			Node(conf),
+			Roles(conf),
+			Search(conf),
+			SearchQL(conf),
+			Shard(conf),
+			Snapshot(conf),
+			Task(conf),
+			Version(conf),
+			Debug(conf),
+			HelpJsonPath(conf),
+			HelpUsage(conf),
+			HelpEsQl(conf),
+		},
+
+		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
+			if err := conf.Init(); err != nil {
+				if len(os.Args) > 1 {
+					return nil, err
+				} else {
+					fmt.Println(cmd.UsageText)
+
+					return nil, nil
+				}
+			}
+
+			log.Init(conf)
+
+			if conf.ProfileFile != "" {
+				// enable  cpu profiling. Do  NOT use q  to stop the  game but
+				// close the window to get a profile
+				fd, err := os.Create(conf.ProfileFile)
+				if err != nil {
+					return nil, err
+				}
+				defer func() {
+					if err := fd.Close(); err != nil {
+						golog.Fatal(err)
+					}
+				}()
+
+				if err := pprof.StartCPUProfile(fd); err != nil {
+					golog.Fatal(err)
+				}
+
+				defer pprof.StopCPUProfile()
+			}
+
+			return nil, nil
+		},
+	}
+
+	return Finish(cmd.Run(context.Background(), os.Args))
+}
+
+func HelpJsonPath(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "help-jsonpath",
 		Usage: "show jsonpath help",

 		Action: func(ctx context.Context, cmd *cli.Command) error {
-			_, err := fmt.Println(msg)
+			_, err := fmt.Println(jsonPathUsage)
+
 			return err
 		},
 	}
 }

+func HelpEsQl(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "help-esql",
+		Usage: "show esql help",
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			assets.LoadEsql()
+
+			width := cfg.GetTermWidth()
+			printer.Pager("esql cheat sheet", string(markdown.Render(assets.EsQlCheatSheet, width, cfg.DefaultMargin)))
+
+			return nil
+		},
+	}
+}
+
 func Version(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:  "version",
 		Usage: "show esctl version information",

 		Action: func(ctx context.Context, cmd *cli.Command) error {
-			_, err := fmt.Printf("esctl version: %s\n  build: %s\n  branch: %s\n  commit: %s\n  go version: %s\n  API Version: %s\n",
+			_, err := fmt.Printf(versionFmt,
 				cfg.Version, cfg.BUILD, cfg.BRANCH, cfg.COMMIT, cfg.GOVERSION, cfg.APIVERSION)
+
 			return err
 		},
 	}
@@ -237,3 +281,109 @@ func Debug(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func HelpUsage(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:               "help-usage",
+		Usage:              "show overview of all available commands",
+		UsageText:          "help-usage [<filter>]",
+		Aliases:            []string{"usage"},
+		CustomHelpTemplate: addReference(`<filter> implies -f`),
+
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:        "hidden",
+				Usage:       "include hidden commands",
+				Destination: &conf.Hidden,
+				Aliases:     []string{"H"},
+			},
+			&cli.BoolFlag{
+				Name:        "full-commands",
+				Usage:       "show full commands",
+				Destination: &conf.Force,
+				Aliases:     []string{"f"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			maxCommandWidth := 0
+			filter := cmd.Args().Get(0)
+
+			if filter != "" {
+				conf.Force = true
+			}
+
+			// first pass, determine max command width
+			if err := walkVisible(conf, cmd.Root(), func(cmd *cli.Command) error {
+				path := cmd.Path()
+				size := len(path[len(path)-1])
+
+				if conf.Force {
+					path := strings.Join(cmd.Path(), " ")
+					size = len(path)
+				}
+
+				if size > maxCommandWidth {
+					maxCommandWidth = size
+				}
+
+				return nil
+			}); err != nil {
+				return err
+			}
+
+			maxCommandWidth += 4 // account for indent width
+
+			// second pass, build tree
+			return walkVisible(conf, cmd.Root(), func(cmd *cli.Command) error {
+				path := cmd.Path()
+
+				if filter != "" {
+					if !strings.Contains(strings.Join(path, " "), filter) {
+						return nil
+					}
+				}
+
+				command := path[len(path)-1]
+				if conf.Force {
+					command = strings.Join(cmd.Path(), " ")
+				}
+
+				if len(path) == 1 || strings.HasSuffix(command, "help") {
+					return nil
+				}
+
+				indent := strings.Repeat("  ", len(path[1:])-1)
+				space := strings.Repeat(" ", maxCommandWidth-(len(command)+len(indent)))
+
+				fmt.Printf("%s%s %s - %s\n", indent, command, space, cmd.Usage)
+
+				return nil
+			})
+		},
+	}
+}
+
+// copy of cmd.Walk() with the exception to skip hidden commands and its siblings
+// see: https://github.com/urfave/cli/issues/2372
+func walkVisible(conf *cfg.Config, cmd *cli.Command, fn func(*cli.Command) error) error {
+	if fn == nil {
+		return nil
+	}
+
+	if !conf.Hidden && cmd.Hidden {
+		return nil
+	}
+
+	if err := fn(cmd); err != nil {
+		return err
+	}
+
+	for _, sub := range cmd.Commands {
+		if err := walkVisible(conf, sub, fn); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
--- a/cmd/search.go
+++ b/cmd/search.go
@@ -18,6 +18,7 @@ package cmd

 import (
 	"context"
+	"strings"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/es"
@@ -45,6 +46,11 @@ https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#dat
 For timestamp formats refer to:
 https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format`

+const QlUsage = `ES|QL documentation:
+https://www.elastic.co/docs/reference/query-languages/esql/esql-getting-started
+
+See also: esctl help-esql`
+
 func Search(conf *cfg.Config) *cli.Command {
 	return &cli.Command{
 		Name:               "search",
@@ -149,3 +155,19 @@ func Search(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func SearchQL(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:               "searchql",
+		Aliases:            []string{"/"},
+		Usage:              "search using ES/QL language",
+		UsageText:          "search <ES/QL term>",
+		CustomHelpTemplate: addReference(QlUsage),
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			args := cmd.Args()
+
+			return es.SearchQL(conf, strings.Join(args.Slice(), " "))
+		},
+	}
+}
--- a/cmd/shards.go
+++ b/cmd/shards.go
@@ -35,6 +35,7 @@ func Shard(conf *cfg.Config) *cli.Command {
 		Commands: []*cli.Command{
 			ShardList(conf),
 			ShardShow(conf),
+			ShardAllocation(conf),
 		},
 	}
 }
@@ -94,3 +95,41 @@ func ShardShow(conf *cfg.Config) *cli.Command {
 		},
 	}
 }
+
+func ShardAllocation(conf *cfg.Config) *cli.Command {
+	return &cli.Command{
+		Name:    "allocation",
+		Aliases: []string{"a"},
+		Usage:   "explain shard allocation",
+
+		Flags: []cli.Flag{
+			&cli.IntFlag{
+				Name:        "shard",
+				Usage:       "shard number to explain for",
+				Destination: &conf.Shards,
+				Aliases:     []string{"s"},
+			},
+			&cli.BoolFlag{
+				Name:        "primary",
+				Usage:       "explain primary allocation (default true)",
+				Destination: &conf.Primary,
+				Aliases:     []string{"p"},
+			},
+			&cli.StringFlag{
+				Name:        "node",
+				Usage:       "explain a shard only if it is currently located on the specified node name or node ID",
+				Destination: &conf.FromNode,
+				Aliases:     []string{"n"},
+			},
+		},
+
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			index := cmd.Args().Get(0)
+			if index == "" {
+				return errors.New("no index specified")
+			}
+
+			return es.ShardAllocation(conf, cmd.Args().Get(0))
+		},
+	}
+}
--- a/cmd/utilities.go
+++ b/cmd/utilities.go
@@ -26,9 +26,10 @@ import (
 func addReference(ref string) string {
 	indentedRef := []string{}

-	for _, line := range strings.Split(ref, "\n") {
+	for line := range strings.SplitSeq(ref, "\n") {
 		indentedRef = append(indentedRef, "   "+line)
 	}
+
 	return fmt.Sprintf("%s\nREFERENCE:\n%s\n",
 		cli.SubcommandHelpTemplate,
 		strings.Join(indentedRef, "\n"))
--- a/commandtree.sh
+++ b/commandtree.sh
@@ -1,31 +0,0 @@
-#!/bin/bash
-
-getcommands() {
-    local command
-    command="$*"
-
-    if ! test "$command" = "help"; then
-        ./esctl $command -h | sed -e '/^COMMANDS:/,/^$/!d;//d' -e 's/^   //' -e 's/[, ].*//' | sort
-    fi
-}
-
-printcommands() {
-    local indent basecommand commands command
-    indent="$1"
-    basecommand="$2"
-    commands="$3"
-
-    for command in $commands; do
-        echo "$indent" "$command"
-
-        commands=$(getcommands $basecommand $command)
-        
-        if test -n "$commands"; then
-            printcommands "${indent}    " "$basecommand $command" "$commands"
-        fi
-    done
-}
-
-
-commands=$(getcommands "")
-printcommands "" "" "$commands"
--- a/go.mod
+++ b/go.mod
@@ -14,11 +14,13 @@
 // along with this program. If not, see <http://www.gnu.org/licenses/>.
 module codeberg.org/scip/esctl

-go 1.25.8
+go 1.26

 require (
 	github.com/MichaelMure/go-term-markdown v0.1.4
 	github.com/alecthomas/repr v0.5.2
+	github.com/charmbracelet/bubbles v1.0.0
+	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/chzyer/readline v1.5.1
 	github.com/dustin/go-humanize v1.0.1
@@ -29,10 +31,11 @@ require (
 	github.com/go-openapi/spec v0.22.5
 	github.com/go-openapi/swag/loading v0.26.1
 	github.com/mattn/go-isatty v0.0.22
-	github.com/olekukonko/tablewriter v1.1.4
+	github.com/seeruk/go-wordwrap v0.0.0-20191208221741-14ec4aac9550
 	github.com/tidwall/gjson v1.19.0
 	github.com/tlinden/yadu v0.1.3
-	github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de
+	github.com/urfave/cli/v3 v3.10.1-0.20260623012112-f980ca84bf65
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -40,9 +43,6 @@ require (
 	github.com/MichaelMure/go-term-text v0.3.1 // indirect
 	github.com/alecthomas/chroma v0.7.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/bubbles v1.0.0 // indirect
-	github.com/charmbracelet/bubbletea v1.3.10 // indirect
 	github.com/charmbracelet/colorprofile v0.4.1 // indirect
 	github.com/charmbracelet/x/ansi v0.11.6 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
@@ -69,7 +69,6 @@ require (
 	github.com/go-openapi/swag/typeutils v0.26.1 // indirect
 	github.com/go-openapi/swag/yamlutils v0.26.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/gomarkdown/markdown v0.0.0-20191123064959-2c17d62f5098 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/kyokomi/emoji/v2 v2.2.8 // indirect
@@ -81,9 +80,6 @@ require (
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/oklog/ulid/v2 v2.1.1 // indirect
-	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
-	github.com/olekukonko/errors v1.2.0 // indirect
-	github.com/olekukonko/ll v0.1.8 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
@@ -93,10 +89,8 @@ require (
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
 	golang.org/x/image v0.0.0-20191206065243-da761ea9ff43 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -14,28 +14,18 @@ github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v1.0.0 h1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=
 github.com/charmbracelet/bubbles v1.0.0/go.mod h1:9d/Zd5GdnauMI5ivUIVisuEm3ave1XwXtD1ckyV6r3E=
 github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
 github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
-github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
 github.com/charmbracelet/colorprofile v0.4.1 h1:a1lO03qTrSIRaK8c3JRxJDZOvhvIeSco3ej+ngLk1kk=
 github.com/charmbracelet/colorprofile v0.4.1/go.mod h1:U1d9Dljmdf9DLegaJ0nGZNJvoXAhayhmidOdcBwAvKk=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
-github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
 github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
 github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
-github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
 github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/chzyer/logex v1.2.1 h1:XHDu3E6q+gdHgsdTPH6ImJMIp436vR6MPtH8gP05QzM=
@@ -114,8 +104,6 @@ github.com/go-openapi/testify/v2 v2.5.1 h1:TMdhCaw8fUNraVSf3Omoob1dO/AzBfhtFAPW0
 github.com/go-openapi/testify/v2 v2.5.1/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
-github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/gomarkdown/markdown v0.0.0-20191123064959-2c17d62f5098 h1:Qxs3bNRWe8GTcKMxYOSXm0jx6j0de8XUtb/fsP3GZ0I=
 github.com/gomarkdown/markdown v0.0.0-20191123064959-2c17d62f5098/go.mod h1:aii0r/K0ZnHv7G0KF7xy1v0A7s2Ljrb5byB7MO5p6TU=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -154,14 +142,6 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=
 github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
-github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
-github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
-github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=
-github.com/olekukonko/errors v1.2.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
-github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8=
-github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw=
-github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
-github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -171,6 +151,8 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/seeruk/go-wordwrap v0.0.0-20191208221741-14ec4aac9550 h1:C3CfUXH/qmWuQFRqnPm3Sx8PFxa+pqACjhV5CaNO8pw=
+github.com/seeruk/go-wordwrap v0.0.0-20191208221741-14ec4aac9550/go.mod h1:Sl541M2Em6rRG3V9WObycR7MYFZiERVkd/TJg0Gt0U4=
 github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -187,8 +169,8 @@ github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tlinden/yadu v0.1.3 h1:5cRCUmj+l5yvlM2irtpFBIJwVV2DPEgYSaWvF19FtcY=
 github.com/tlinden/yadu v0.1.3/go.mod h1:l3bRmHKL9zGAR6pnBHY2HRPxBecf7L74BoBgOOpTcUA=
-github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de h1:ESKPiS7inVoBnv4FmgGNZdjWBI/wmvaragoyD3D9nM4=
-github.com/urfave/cli/v3 v3.9.1-0.20260524212652-be8b79d0c8de/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.10.1-0.20260623012112-f980ca84bf65 h1:NXitXXO9DupDLEFj8hIyYtsubRxSFTp5JXqohElT0nU=
+github.com/urfave/cli/v3 v3.10.1-0.20260623012112-f980ca84bf65/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
@@ -219,8 +201,6 @@ golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
 golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
--- a/pkg/cfg/cluster.go
+++ b/pkg/cfg/cluster.go
@@ -0,0 +1,235 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cfg
+
+import (
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/elastic/elastic-transport-go/v8/elastictransport"
+	"github.com/elastic/go-elasticsearch/v9"
+	"golang.org/x/term"
+	"gopkg.in/yaml.v3"
+)
+
+// used in general config struct
+type Cluster struct {
+	Name, Uri, User, Pass, Token string
+	client                       *elasticsearch.TypedClient
+	Default, DebugHTTP           bool
+}
+
+// used just for writing back to the config file
+type ClusterConfig struct {
+	Uri, User, Pass, Token string
+	Default                bool
+}
+
+// to write the config, we avoid all other config settings
+type WriteConfig struct {
+	Clusters map[string]*ClusterConfig
+}
+
+func (cluster *Cluster) SetClient(client *elasticsearch.TypedClient) {
+	cluster.client = client
+}
+
+// return the  go-elasticsearch client  object but before  doing that,
+// check if we need to tune auth
+func (cluster *Cluster) ES() *elasticsearch.TypedClient {
+	if cluster.client == nil {
+		fmt.Println("no current cluster, use 'esctl cluster switch <name>' to set one")
+		os.Exit(1)
+	}
+
+	if err := cluster.CheckAuth(); err != nil {
+		fmt.Printf("Error: %s", err)
+		os.Exit(1)
+	}
+
+	return cluster.client
+}
+
+// add authentication to es client, if not yet done
+func (cluster *Cluster) CheckAuth() error {
+	if cluster.Pass == "" && cluster.User != "" && cluster.Token == "" && cluster.Default {
+		// no token - user is set, but no password.
+
+		// check if the env var is set
+		pass := os.Getenv("ES_PASS")
+		if pass != "" {
+			cluster.Pass = pass
+		} else {
+			// k, try interactively
+			fmt.Fprintf(os.Stderr, "Enter password for elasticsearch user %s@%s: ", cluster.User, cluster.Name)
+
+			pass, err := term.ReadPassword(syscall.Stdin)
+			if err != nil {
+				return err
+			}
+
+			passwd := strings.TrimSpace(string(pass))
+			if passwd == "" {
+				return errors.New("password empty")
+			}
+
+			cluster.Pass = string(pass)
+
+			fmt.Println()
+		}
+
+		opts := cluster.getDefaultOptions()
+		opts = append(opts, elasticsearch.WithBasicAuth(cluster.User, cluster.Pass))
+
+		es, err := elasticsearch.NewTyped(opts...)
+		if err != nil {
+			return fmt.Errorf("failed to setup elasticsearch connection: %w", err)
+		}
+
+		cluster.SetClient(es)
+	}
+
+	return nil
+}
+
+// set Default=true for the given cluster in the config (if exists)
+func (conf *Config) SwitchCluster(name string) error {
+	_, exists := conf.Clusters[name]
+	if !exists {
+		return errors.New("no cluster with that name configured")
+	}
+
+	cfg := WriteConfig{Clusters: map[string]*ClusterConfig{}}
+
+	for clustername, cluster := range conf.Clusters {
+		cfg.Clusters[clustername] = &ClusterConfig{
+			Uri:     cluster.Uri,
+			User:    cluster.User,
+			Pass:    cluster.Pass,
+			Token:   cluster.Token,
+			Default: false,
+		}
+
+		if clustername == name {
+			cfg.Clusters[clustername].Default = true
+		}
+	}
+
+	raw, err := yaml.Marshal(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to marshal cluster config: %w", err)
+	}
+
+	outfile := getDefaultPath()
+	if conf.ConfigFile != "" {
+		outfile = conf.ConfigFile
+	}
+
+	if err := os.WriteFile(outfile, raw, 0600); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// We do NOT  use go-elasticsearch to check  for cluster reachability,
+// because  at this  stage,  auth  may not  have  been configured.  So
+// instead we just connect to  the cluster using plan net/tcp
+func (cluster *Cluster) IsReachable() (bool, error) {
+	timeout := 500 * time.Millisecond
+
+	url := strings.TrimPrefix(strings.TrimPrefix(cluster.Uri, "https://"), "http://")
+
+	host := strings.Split(url, "/")
+
+	if !strings.Contains(host[0], ":") {
+		host[0] += ":443"
+	}
+
+	conn, err := net.DialTimeout("tcp", host[0], timeout)
+	if err != nil {
+		return false, err
+	}
+
+	return true, conn.Close()
+}
+
+func (cluster *Cluster) getDefaultOptions() []elasticsearch.Option {
+	// These headers are  not needed with ES 9, but with  ES 8, we set
+	// them here  so every API call uses it.  The only exception being
+	// the api repl, which does it on its own.
+	headers := http.Header{}
+	headers.Add("Content-Type", "application/json")
+	headers.Add("Accept", "application/json")
+
+	return []elasticsearch.Option{
+		elasticsearch.WithAddresses(cluster.Uri),
+		elasticsearch.WithTransportOptions(
+			cluster.getTransport(),
+			elastictransport.WithHeader(headers),
+		),
+		elasticsearch.WithCompatibilityMode(),
+	}
+}
+
+func (cluster *Cluster) getTransport() elastictransport.Option {
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
+
+	if cluster.DebugHTTP {
+		return elastictransport.WithTransport(
+			&DebugTransport{Transport: transport},
+		)
+	}
+
+	return elastictransport.WithTransport(
+		&CompatibilityTransport{Transport: transport},
+	)
+}
+
+func (conf *Config) SetupES() error {
+	for name, cluster := range conf.Clusters {
+		cluster.Name = name
+		cluster.DebugHTTP = conf.DebugHTTP
+
+		opts := cluster.getDefaultOptions()
+
+		switch {
+		case cluster.Pass != "" && cluster.User != "":
+			opts = append(opts, elasticsearch.WithBasicAuth(cluster.User, cluster.Pass))
+		case cluster.Token != "":
+			opts = append(opts, elasticsearch.WithAPIKey(cluster.Token))
+		}
+
+		es, err := elasticsearch.NewTyped(opts...)
+		if err != nil {
+			return fmt.Errorf("failed to setup elasticsearch connection: %w", err)
+		}
+
+		cluster.SetClient(es)
+	}
+
+	return nil
+}
--- a/pkg/cfg/config.go
+++ b/pkg/cfg/config.go
@@ -17,25 +17,18 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package cfg

 import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"encoding/json"
 	"errors"
 	"fmt"
-	"log/slog"
-	"net/http"
 	"os"
+	"path/filepath"
 	"reflect"

 	"github.com/alecthomas/repr"
-	"github.com/elastic/elastic-transport-go/v8/elastictransport"
-	"github.com/elastic/go-elasticsearch/v9"
 	"gopkg.in/yaml.v3"
 )

 const (
-	Version string = `v0.0.20`
+	Version string = `v0.0.26`
 )

 var (
@@ -43,11 +36,6 @@ var (
 	APIVERSION, GOVERSION, BUILD, COMMIT, BRANCH string
 )

-type Cluster struct {
-	Uri, User, Pass string
-	ES              *elasticsearch.TypedClient
-}
-
 type Config struct {
 	ConfigFile     string // -c
 	CurrentCluster string // -C
@@ -57,11 +45,13 @@ type Config struct {
 	DefaultCluster *Cluster
 	HaveJQ         bool   // determined at runtime by ourselfes
 	ProfileFile    string // for internal use (golang profiling)
+	AlignInts      bool   // -I

 	Index            string // index: -i
 	Failed, Partials bool   // index: flags
 	Shards, Replicas int    // index create+allocation: -s -r
 	Wait             bool   // index create: -w
+	Policy           string // index create: -p
 	Primary          bool   // index allocation: -p
 	Searchable       bool   // index fields: -s
 	Aggretable       bool   // index fields: -a
@@ -92,8 +82,9 @@ type Config struct {
 	SortBy    string // sort: -k
 	Ascending bool   // sort: -a

+	All                            bool   // doc + node ls: -a
 	Exclude                        string // cluster compare: -e (regexp)
-	All, Verbose                   bool   // cluster status: -a -v
+	Verbose                        bool   // cluster status: -v
 	Persistent, Transient, Default bool   // cluster settings set: -p -t -D

 	Force bool // ccr follower renew: -f
@@ -110,22 +101,33 @@ type Config struct {
 	MaxDocs, MaxShardSize, MaxShardDocs int  // roll over
 	DryRun                              bool // rollover: -n

-	Tag string // api ls: -t
+	Tag      string // api ls: -t
+	HumanCat bool   // api repl: -H

 	Ilm Ilm // ilm create
+
+	FromNode, ToNode             string // cluster reroute move: -f + -t
+	AllowPrimary, AcceptDataLoss bool   // cluster reroute cancel: -p,-a
+
+	Pager string // api repl: -p || PAGER
 }

 func NewConfig() *Config {
 	return &Config{Clusters: map[string]*Cluster{}}
 }

+func getDefaultPath() string {
+	return filepath.Join([]string{os.Getenv("HOME"), ".config", "esctl", "config.yaml"}...)
+}
+
 func (conf *Config) Init() error {
-	DefaultConfig := os.Getenv("HOME") + "/.config/esctl/config.yaml"
+	DefaultConfig := getDefaultPath()
+
+	if conf.ConfigFile == "" && fileExists(DefaultConfig) {
+		conf.ConfigFile = DefaultConfig
+	}

 	switch {
-	case fileExists(DefaultConfig):
-		conf.ConfigFile = DefaultConfig
-		fallthrough
 	case conf.ConfigFile != "":
 		if err := conf.LoadConfig(); err != nil {
 			return err
@@ -140,33 +142,8 @@ func (conf *Config) Init() error {
 		return err
 	}

-	if conf.CurrentCluster != "" {
-		current, exists := conf.Clusters[conf.CurrentCluster]
-		if !exists {
-			return fmt.Errorf("no cluster with alias %s configured", conf.CurrentCluster)
-		} else {
-			conf.DefaultCluster = current
-		}
-	} else {
-		if len(conf.Clusters) == 1 {
-			for name, cluster := range conf.Clusters {
-				conf.DefaultCluster = cluster
-				conf.CurrentCluster = name
-			}
-		} else {
-			for name, cluster := range conf.Clusters {
-				_, err := cluster.ES.Cluster.Health().
-					Header("content-type", "application/json").
-					Header("accept", "application/json").
-					Do(context.Background())
-
-				if err == nil {
-					conf.DefaultCluster = cluster
-					conf.CurrentCluster = name
-					break
-				}
-			}
-		}
+	if err := conf.determineDefaultCluster(); err != nil {
+		return err
 	}

 	conf.HaveJQ = isJQinstalled()
@@ -184,14 +161,14 @@ func (conf *Config) Clone() Config {
 	ref := reflect.ValueOf(*conf)
 	typeOfS := ref.Type()

-	for i := 0; i < ref.NumField(); i++ {
-		field := typeOfS.Field(i).Name
+	for idx := range ref.NumField() {
+		field := typeOfS.Field(idx).Name

-		if field == "Clusters" || field == "DefaultCluster" || !ref.Field(i).CanInterface() {
+		if field == "Clusters" || field == "DefaultCluster" || !ref.Field(idx).CanInterface() {
 			continue
 		}

-		reflect.ValueOf(&clone).Elem().FieldByName(field).Set(reflect.ValueOf(ref.Field(i).Interface()))
+		reflect.ValueOf(&clone).Elem().FieldByName(field).Set(reflect.ValueOf(ref.Field(idx).Interface()))
 	}

 	return clone
@@ -210,18 +187,17 @@ func (conf *Config) PrintDebug() {

 func (conf *Config) LoadEnv() error {
 	cluster := Cluster{
-		Uri:  os.Getenv("ES_URI"),
-		User: os.Getenv("ES_USER"),
-		Pass: os.Getenv("ES_PASS"),
+		Uri:   os.Getenv("ES_URI"),
+		User:  os.Getenv("ES_USER"),
+		Pass:  os.Getenv("ES_PASS"),
+		Token: os.Getenv("ES_TOKEN"),
 	}

 	switch {
 	case cluster.Uri == "":
 		return errors.New("ES_URI unset")
-	case cluster.User == "":
-		return errors.New("ES_USER unset")
-	case cluster.Pass == "":
-		return errors.New("ES_PASS unset")
+	case cluster.User == "" || cluster.Token == "":
+		return errors.New("ES_USER and ES_TOKEN unset")
 	}

 	conf.Clusters["default"] = &cluster
@@ -250,89 +226,63 @@ func (conf *Config) LoadConfig() error {
 	if len(newconf.Clusters) > 0 {
 		conf.Clusters = newconf.Clusters

-		_, exists := conf.Clusters["default"]
-		if !exists {
-			// no "default", just use the first we stumble upon
-			for _, cluster := range conf.Clusters {
+		for _, cluster := range conf.Clusters {
+			if cluster.Default {
 				conf.DefaultCluster = cluster
+
 				break
 			}
+		}
+
+		if conf.DefaultCluster == nil {
+			conf.DefaultCluster = &Cluster{}
+		}
+	}
+
+	return nil
+}
+
+func (conf *Config) determineDefaultCluster() error {
+	if conf.CurrentCluster != "" {
+		// -C specified, set current cluster explicitly, no matter what the config says
+		current, exists := conf.Clusters[conf.CurrentCluster]
+		if !exists {
+			return fmt.Errorf("no cluster with alias %s configured", conf.CurrentCluster)
 		} else {
-			conf.DefaultCluster = newconf.Clusters["default"]
+			conf.DefaultCluster = current
+
+			// disable all others
+			for _, cluster := range conf.Clusters {
+				cluster.Default = false
+			}
+
+			conf.DefaultCluster.Default = true
+		}
+	} else {
+		// we need to determine ourselfes
+		if len(conf.Clusters) == 1 {
+			// ok, just one cluster configured, use this, of course
+			for name, cluster := range conf.Clusters {
+				conf.DefaultCluster = cluster
+				conf.CurrentCluster = name
+				conf.DefaultCluster.Default = true
+			}
+		} else {
+			// multiple ones exists, look if one is set as default
+			for name, cluster := range conf.Clusters {
+				if cluster.Default {
+					conf.DefaultCluster = cluster
+					conf.CurrentCluster = name
+				}
+			}
 		}
 	}

 	return nil
 }

-func (conf *Config) getTransport() elastictransport.Option {
-	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-	}
-
-	if conf.DebugHTTP {
-		return elastictransport.WithTransport(
-			&DebugTransport{Transport: transport},
-		)
-	}
-
-	return elastictransport.WithTransport(transport)
-}
-
-func (conf *Config) SetupES() error {
-	for _, cluster := range conf.Clusters {
-		es, err := elasticsearch.NewTyped(
-			elasticsearch.WithAddresses(cluster.Uri),
-			elasticsearch.WithBasicAuth(cluster.User, cluster.Pass),
-			elasticsearch.WithTransportOptions(conf.getTransport()),
-		)
-
-		if err != nil {
-			return fmt.Errorf("failed to setup elasticsearch connection: %w", err)
-		}
-
-		cluster.ES = es
-	}
-
-	return nil
-}
-
-// used to print uri, path and body of a request made by the go-client
-type DebugTransport struct {
-	Transport http.RoundTripper
-}
-
-func (t *DebugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	content := ""
-	contentline := ""
-
-	if req.ContentLength > 0 {
-		buf := new(bytes.Buffer)
-		body, _ := req.GetBody()
-
-		_, err := buf.ReadFrom(body)
-		if err != nil {
-			return nil, err
-		}
-
-		var pretty bytes.Buffer
-		err = json.Indent(&pretty, buf.Bytes(), "", "\t")
-		if err != nil {
-			return nil, fmt.Errorf("json parse error: %s", err)
-		}
-
-		content = pretty.String()
-		contentline = buf.String()
-	}
-
-	slog.Info("req", "host", req.URL.Host, "uri", req.URL.Path, "body", content, "bodyline", contentline)
-
-	return t.Transport.RoundTrip(req)
-}
-
 func fileExists(filename string) bool {
 	info, err := os.Stat(filename)
-
 	if err != nil {
 		// return false on any error
 		return false
--- a/pkg/cfg/ilm.go
+++ b/pkg/cfg/ilm.go
@@ -21,7 +21,7 @@ type Ilm struct {

 	HotMinAge                      string
 	HotRolloverMaxAge              string
-	HotRolloverMaxPrimaryShardSize int64
+	HotRolloverMaxPrimaryShardSize string
 	HotRolloverMaxDocs             int64
 	HotReadonly                    bool

@@ -35,17 +35,21 @@ type Ilm struct {
 	ColdForceMerge             int
 	ColdPriority               int

-	FrozenMinAge string
+	FrozenMinAge                 string
+	FrozenSearchableSnapshotRepo string

 	DeleteMinAge              string
 	DeleteSearchableSnapshots bool
+
+	MinAge, FromPhase, Within string // forecast
+	Tree                      bool
 }

 func (cfg *Ilm) HaveHot() bool {
 	return cfg.HotMinAge != "" ||
 		cfg.HotRolloverMaxAge != "" ||
 		cfg.HotRolloverMaxDocs > 0 ||
-		cfg.HotRolloverMaxPrimaryShardSize > 0 ||
+		cfg.HotRolloverMaxPrimaryShardSize != "" ||
 		cfg.HotReadonly
 }

--- a/pkg/cfg/jq.go
+++ b/pkg/cfg/jq.go
@@ -25,6 +25,7 @@ import (

 func isJQinstalled() bool {
 	cmd := exec.CommandContext(context.Background(), "jq", "-h")
+
 	out, err := cmd.Output()
 	if err != nil {
 		return false
--- a/pkg/cfg/term.go
+++ b/pkg/cfg/term.go
@@ -0,0 +1,49 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cfg
+
+import (
+	"os"
+
+	"golang.org/x/term"
+)
+
+const (
+	DefaultMargin = 4
+)
+
+func GetTermWidth() int {
+	if term.IsTerminal(int(os.Stdout.Fd())) {
+		width, _, err := term.GetSize(int(os.Stdout.Fd()))
+		if err == nil {
+			return width - DefaultMargin
+		}
+	}
+
+	return 80
+}
+
+func GetTermHeight() int {
+	if term.IsTerminal(int(os.Stdout.Fd())) {
+		_, height, err := term.GetSize(int(os.Stdout.Fd()))
+		if err == nil {
+			return height
+		}
+	}
+
+	return 25
+}
--- a/pkg/cfg/transport.go
+++ b/pkg/cfg/transport.go
@@ -0,0 +1,93 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package cfg
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+)
+
+// used to print uri, path and body of a request made by the go-client
+type DebugTransport struct {
+	Transport http.RoundTripper
+}
+
+func (t *DebugTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	content := ""
+	contentline := ""
+
+	if req.ContentLength > 0 {
+		buf := new(bytes.Buffer)
+		body, _ := req.GetBody()
+
+		_, err := buf.ReadFrom(body)
+		if err != nil {
+			return nil, err
+		}
+
+		var pretty bytes.Buffer
+
+		err = json.Indent(&pretty, buf.Bytes(), "", "\t")
+		if err != nil {
+			return nil, fmt.Errorf("json parse error: %w", err)
+		}
+
+		content = pretty.String()
+		contentline = buf.String()
+	}
+
+	req = fixRequestHeaders(req)
+
+	slog.Info("req", "host", req.URL.Host, "uri", req.URL.Path,
+		"body", content, "bodyline", contentline,
+		"headers", req.Header,
+	)
+
+	return t.Transport.RoundTrip(req)
+}
+
+type CompatibilityTransport struct {
+	Transport http.RoundTripper
+}
+
+func (t *CompatibilityTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = fixRequestHeaders(req)
+
+	return t.Transport.RoundTrip(req)
+}
+
+// Fixes https://codeberg.org/scip/esctl/issues/79:
+// the API client has this Accept header hardcoded everywhere:
+// req.Header.Set("Accept", "application/vnd.elasticsearch+json;compatible-with=9")
+// While this works pretty well with ES9, it doesn't with ES8. So, we replace
+// this header with a new one without the compatibility part.
+func fixRequestHeaders(req *http.Request) *http.Request {
+	if req.Header.Get("Accept") != "" {
+		req.Header.Del("Accept")
+		req.Header.Add("Accept", "application/json")
+	}
+
+	if req.Header.Get("Content-Type") != "" {
+		req.Header.Del("Content-Type")
+		req.Header.Add("Content-Type", "application/json")
+	}
+
+	return req
+}
--- a/pkg/es/api.go
+++ b/pkg/es/api.go
@@ -26,6 +26,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"log/slog"
 	"net/http"
 	"os"
@@ -41,27 +42,28 @@ import (
 	"github.com/charmbracelet/lipgloss"
 	"github.com/chzyer/readline"
 	"github.com/go-openapi/spec"
-	"golang.org/x/term"
 )

 const (
-	DefaultMargin = 4
-	intro         = `Input format: verb path [data]"
-
-Example:
-
-post /yourindex/_ccr/pause_follow
-put /yourindex/_settings {"number_of_replicas": 1}
-
-You can also put multiline JSON after the path like:
-
-put /yourindex/_settings
-{
-  "number_of_replicas": 1
-}
-
-If you do NOT  supply a JSON in the first line, you  need to hit ENTER
-twice to complete.`
+	intro = `# Input format: verb path [data]"
+# 
+# Example:
+# 
+# post /yourindex/_ccr/pause_follow
+# put /yourindex/_settings {"number_of_replicas": 1}
+# 
+# You can also put multiline JSON after the path like:
+# 
+# put /yourindex/_settings
+# {
+#   "number_of_replicas": 1
+# }
+# 
+# If you do NOT  supply a JSON in the first line, you  need to hit ENTER
+# twice to complete.
+#
+# Supply the flag --human-readable-cat, -H to view /_cat API calls in
+# human readable form.`
 )

 // holds an API operation via go-openapi/spec
@@ -94,9 +96,8 @@ func ApiRepl(conf *cfg.Config) error {
 		EOFPrompt:         "exit",
 		HistorySearchFold: true,
 	})
-
 	if err != nil {
-		return fmt.Errorf("failed to initialize readline lib: %s", err)
+		return fmt.Errorf("failed to initialize readline lib: %w", err)
 	}

 	for {
@@ -114,11 +115,13 @@ func ApiRepl(conf *cfg.Config) error {
 		parts := strings.SplitN(strings.TrimSpace(text), " ", 3)
 		if len(parts) < 2 {
 			fmt.Println("error: you need to input a verb, uri [and post data]")
+
 			continue
 		}

 		if !slices.Contains(verbs, strings.ToLower(parts[0])) {
 			fmt.Println("error: verb must be one of " + strings.Join(verbs, ","))
+
 			continue
 		}

@@ -143,14 +146,58 @@ func ApiRepl(conf *cfg.Config) error {
 			fmt.Printf("failed to call API: %s\n", esErrorString(err))
 		}

-		if err := prettyfiJson(conf, raw); err != nil {
-			fmt.Println(err)
+		if conf.HumanCat && strings.HasPrefix(parts[1], "/_cat") {
+			fmt.Println(string(raw))
+		} else {
+			pageJsonOutput(conf, raw)
 		}
 	}

+	//nolint:nilerr
 	return nil
 }

+func pageJsonOutput(conf *cfg.Config, raw []byte) {
+	tmpconf := &cfg.Config{HaveJQ: conf.HaveJQ}
+
+	if conf.Pager != "" {
+		tmpconf.HaveJQ = false
+	}
+
+	output, err := prettyfiJson(tmpconf, raw)
+	if err != nil {
+		fmt.Println(err)
+	}
+
+	lines := len(strings.Split(output, "\n"))
+	height := cfg.GetTermHeight()
+
+	if lines > height {
+		if conf.Pager != "" {
+			cmd := strings.Split(conf.Pager, " ")
+			pager := exec.Command(cmd[0], cmd[1:]...)
+
+			var buf bytes.Buffer
+			buf.WriteString(output)
+
+			pager.Stdout = os.Stdout
+			pager.Stdin = &buf
+			pager.Stderr = os.Stderr
+
+			err := pager.Run()
+			if err != nil {
+				fmt.Printf("failed to execute pager '%s': %s", conf.Pager, err)
+			}
+		} else {
+			printer.Pager("json output", output)
+		}
+
+		return
+	}
+
+	fmt.Println(output)
+}
+
 func encodeAuth(username, password string) string {
 	return base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
 }
@@ -159,72 +206,94 @@ func CallAPI(conf *cfg.Config, verb, path, data string) ([]byte, error) {
 	verb = strings.ToUpper(verb)

 	// we're using port-forwards anyway
-	tr := &http.Transport{
+	noVerifyTransport := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 	}

-	client := &http.Client{Transport: tr}
+	client := &http.Client{Transport: noVerifyTransport}
+
+	if conf.DebugHTTP {
+		client = &http.Client{
+			Transport: &cfg.DebugTransport{
+				Transport: noVerifyTransport}}
+	}

 	req, err := http.NewRequest(verb, conf.DefaultCluster.Uri+path, bytes.NewBuffer([]byte(data)))
 	if err != nil {
 		return nil, err
 	}

-	req.Header.Add("Content-Type", "application/json")
-	req.Header.Add("accept", "application/json")
-	req.Header.Add("Authorization", "Basic "+encodeAuth(conf.DefaultCluster.User, conf.DefaultCluster.Pass))
+	if !conf.HumanCat || (conf.HumanCat && !strings.HasPrefix(path, "/_cat")) {
+		req.Header.Add("Content-Type", "application/json")
+		req.Header.Add("Accept", "application/json")
+	}
+
+	// make sure we have got all we need
+	if err := conf.DefaultCluster.CheckAuth(); err != nil {
+		return nil, err
+	}
+
+	if conf.DefaultCluster.Token != "" {
+		req.Header.Add("Authorization", "APIKey "+conf.DefaultCluster.Token)
+	} else {
+		req.Header.Add("Authorization", "Basic "+encodeAuth(conf.DefaultCluster.User, conf.DefaultCluster.Pass))
+	}

 	// actually execute the request
 	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err
 	}
+	defer func() {
+		if err := resp.Body.Close(); err != nil {
+			log.Fatal(err)
+		}
+	}()

 	// Read and print response
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read response body: %s", err)
+		return nil, fmt.Errorf("failed to read response body: %w", err)
 	}

 	return body, nil
 }

-func prettyfiJson(conf *cfg.Config, raw []byte) error {
+func prettyfiJson(conf *cfg.Config, raw []byte) (string, error) {
 	if conf.HaveJQ {
 		cmd := exec.CommandContext(context.Background(), "jq", "-C")
 		cmd.Stdin = bytes.NewReader(raw)

 		var out bytes.Buffer
+
 		cmd.Stdout = &out

 		err := cmd.Run()
 		if err != nil {
-			return err
+			return "", err
 		}

-		fmt.Println(out.String())
-
-		return nil
+		return out.String(), nil
 	}

 	var pretty bytes.Buffer
+
 	err := json.Indent(&pretty, raw, "", "\t")
 	if err != nil {
-		return fmt.Errorf("json parse error: %s", err)
+		//nolint:nilerr
+		return string(raw), nil
 	}

-	fmt.Println(pretty.String())
-
-	return nil
+	return pretty.String(), nil
 }

 // interactively  read  arbitrary  JSON  data  from  STDIN,  which  is
 // virtually a repl inside the primary repl
 func readJSON(input string) (string, error) {
-	data := ""
+	data := strings.Builder{}

 	if input != "" {
-		data = input
+		data.WriteString(input)
 	} else {
 		scanner := bufio.NewScanner(os.Stdin)
 		for scanner.Scan() {
@@ -234,23 +303,23 @@ func readJSON(input string) (string, error) {
 				break
 			}

-			data += line
+			data.WriteString(line)
 		}
 	}

-	if data == "" {
-		return data, nil
+	if data.Len() == 0 {
+		return "", nil
 	}

 	// validate
 	check := map[string]any{}
-	err := json.Unmarshal([]byte(data), &check)
-	if err != nil {
-		return "", fmt.Errorf("error: input data is not proper JSON: %s", err)

+	err := json.Unmarshal([]byte(data.String()), &check)
+	if err != nil {
+		return "", fmt.Errorf("error: input data is not proper JSON: %w", err)
 	}

-	return data, nil
+	return data.String(), nil
 }

 func ApiList(conf *cfg.Config, pattern string) error {
@@ -289,6 +358,7 @@ func ApiList(conf *cfg.Config, pattern string) error {
 	}

 	table.Sort()
+
 	return table.Print()
 }

@@ -296,10 +366,13 @@ func ApiList(conf *cfg.Config, pattern string) error {
 func ApiPathNames() []string {
 	assets.LoadAssetOpenApi()

-	paths := []string{}
+	paths := make([]string, len(assets.OpenAPI.Spec().Paths.Paths))
+
+	idx := 0

 	for path := range assets.OpenAPI.Spec().Paths.Paths {
-		paths = append(paths, path)
+		paths[idx] = path
+		idx++
 	}

 	return paths
@@ -307,6 +380,7 @@ func ApiPathNames() []string {

 func ApiShow(conf *cfg.Config, showpath, verb string) error {
 	assets.LoadAssetOpenApi()
+
 	out := printer.Builder{}

 	op, err := matchOperation(showpath, verb)
@@ -318,23 +392,25 @@ func ApiShow(conf *cfg.Config, showpath, verb string) error {

 	cleanMarkup := regexp.MustCompile(`<[^<>]+>`)

-	width := getTermWidth()
+	width := cfg.GetTermWidth()
 	params := getApiParameters(op, showpath, width)
 	sample := getApiExample(op)
-	description := markdown.Render(cleanMarkup.ReplaceAllString(op.Op.Description, ""), width, DefaultMargin)
+	description := markdown.Render(cleanMarkup.ReplaceAllString(op.Op.Description, ""), width, cfg.DefaultMargin)

-	var bold = lipgloss.NewStyle().
-		Bold(true)
-	var paragraph = lipgloss.NewStyle().
-		MarginBottom(1).
-		MarginLeft(DefaultMargin)
-	var boldparagraph = lipgloss.NewStyle().
-		MarginBottom(1).
-		MarginLeft(DefaultMargin).
-		Bold(true)
-	var indentparagraph = lipgloss.NewStyle().
-		MarginBottom(1).
-		MarginLeft(2)
+	var (
+		bold = lipgloss.NewStyle().
+			Bold(true)
+		paragraph = lipgloss.NewStyle().
+				MarginBottom(1).
+				MarginLeft(cfg.DefaultMargin)
+		boldparagraph = lipgloss.NewStyle().
+				MarginBottom(1).
+				MarginLeft(cfg.DefaultMargin).
+				Bold(true)
+		indentparagraph = lipgloss.NewStyle().
+				MarginBottom(1).
+				MarginLeft(2)
+	)

 	out.WriteStringLine(bold.Render("ID: " + op.Op.ID))
 	out.WriteStringLine(paragraph.Render(fmt.Sprintf("%s %s", op.Verb, showpath)))
@@ -350,10 +426,11 @@ func ApiShow(conf *cfg.Config, showpath, verb string) error {

 	if len(params.Path) > 0 {
 		out.WriteStringLine(bold.Render("Path Parameters"))
+
 		for _, param := range params.Path {
 			out.WriteStringLine(boldparagraph.Render(param.Param))
+
 			if param.Description != "" {
-				//out.WriteStringLine(indentparagraph.Render(param.Description))
 				out.WriteStringLine(param.Description)
 			}
 		}
@@ -361,8 +438,10 @@ func ApiShow(conf *cfg.Config, showpath, verb string) error {

 	if len(params.Query) > 0 {
 		out.WriteStringLine(bold.Render("Query Parameters"))
+
 		for _, param := range params.Query {
 			out.WriteStringLine(boldparagraph.Render(param.Param))
+
 			if param.Description != "" {
 				out.WriteStringLine(indentparagraph.Render(param.Description))
 			}
@@ -413,7 +492,7 @@ func getApiParameters(op *Op, path string, width int) Params {
 			}
 		} else {
 			par := Param{
-				Description: string(markdown.Render(param.Description, width, DefaultMargin)),
+				Description: string(markdown.Render(param.Description, width, cfg.DefaultMargin)),
 				Param:       param.Name,
 			}

@@ -444,10 +523,8 @@ func getApiExample(op *Op) string {
 					if hassource {
 						sample = strings.TrimSpace(source.(string))
 					}
-
 				}
 			}
-
 		}
 	}

@@ -460,11 +537,13 @@ func getApiExample(op *Op) string {
 func matchOperation(showpath, verb string) (*Op, error) {
 	ops := []*Op{}
 	op := &Op{}
+
 	var found bool

 	for path, item := range assets.OpenAPI.Spec().Paths.Paths {
 		if path == showpath {
 			ops = findOperation(item.PathItemProps)
+
 			break
 		}
 	}
@@ -481,6 +560,7 @@ func matchOperation(showpath, verb string) (*Op, error) {
 		if strings.ToLower(item.Verb) == verb {
 			op = item
 			found = true
+
 			break
 		}
 	}
@@ -517,14 +597,3 @@ func findOperation(item spec.PathItemProps) []*Op {

 	return ops
 }
-
-func getTermWidth() int {
-	if term.IsTerminal(int(os.Stdout.Fd())) {
-		width, _, err := term.GetSize(int(os.Stdout.Fd()))
-		if err == nil {
-			return width - DefaultMargin
-		}
-	}
-
-	return 80
-}
--- a/pkg/es/ccr.go
+++ b/pkg/es/ccr.go
@@ -46,23 +46,18 @@ func CcrStatus(conf *cfg.Config, leader, follower string) error {
 		}

 		// reverse attribution
-		f := follower
-		follower = leader
-		leader = f
+		follower, leader = leader, follower
+
 		slog.Debug("leader/follower attribution is invalid, reversing", "leader", leader, "follower", follower)
 	}

 	indices := ClusterIndices{}

 	for _, alias := range []string{leader, follower} {
-		cat := conf.Clusters[alias].ES.Cat.Indices().
-			// we need to add custom request headers, required for older ES instances
-			Header("content-type", "application/json").
-			Header("accept", "application/json")
-
-		res, err := cat.Do(context.Background())
+		res, err := conf.Clusters[alias].ES().Cat.Indices().
+			Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to get indicies on %s: %s", alias, esErrorString(err))
+			return fmt.Errorf("failed to get indicies on %s: %w", alias, esErrorString(err))
 		}

 		indices[alias] = make(map[string]*types.IndicesRecord, len(res))
@@ -88,27 +83,27 @@ func CcrStatus(conf *cfg.Config, leader, follower string) error {
 }

 func CcrRemoteInfo(conf *cfg.Config, index string) error {
-	res, err := conf.DefaultCluster.ES.Cluster.RemoteInfo().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Cluster.RemoteInfo().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve follower info: %s", esErrorString(err))
+		return fmt.Errorf("failed to retrieve follower info: %w", esErrorString(err))
 	}

 	slog.Debug("ccr remote info", "info", res)

 	remote := ""
+
 	var info *types.ClusterRemoteProxyInfo

 	for name, data := range res {
 		remote = name
 		info = data.(*types.ClusterRemoteProxyInfo)
+
 		break
 	}

 	if remote == "" {
-		return fmt.Errorf("cluster doesn't follow any other: %s", err)
+		return errors.New("cluster doesn't follow any other")
 	}

 	mode := "follower"
@@ -119,11 +114,11 @@ func CcrRemoteInfo(conf *cfg.Config, index string) error {
 	table := printer.NewTable(conf, 2, 5)
 	table.Addheaders("ccr remote property", "value")

-	table.Entries = [][]string{
+	table.Entries = [][]any{
 		{"Remote Cluster", remote},
 		{"CCR Mode", mode},
-		{"Connected", fmt.Sprintf("%t", info.Connected)},
-		{"Num Proxy Sockets Connected", fmt.Sprintf("%d", info.NumProxySocketsConnected)},
+		{"Connected", info.Connected},
+		{"Num Proxy Sockets Connected", info.NumProxySocketsConnected},
 		{"Proxy Address", info.ProxyAddress},
 	}

--- a/pkg/es/ccr_follower.go
+++ b/pkg/es/ccr_follower.go
@@ -18,6 +18,7 @@ package es

 import (
 	"context"
+	"errors"
 	"fmt"
 	"log/slog"

@@ -26,22 +27,21 @@ import (
 )

 func getRemoteName(conf *cfg.Config) (string, error) {
-	res, err := conf.DefaultCluster.ES.Cluster.RemoteInfo().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Cluster.RemoteInfo().
 		Do(context.Background())
 	if err != nil {
-		return "", fmt.Errorf("failed to retrieve follower info: %s", esErrorString(err))
+		return "", fmt.Errorf("failed to retrieve follower info: %w", esErrorString(err))
 	}

 	remote := ""
 	for name := range res {
 		remote = name
+
 		break
 	}

 	if remote == "" {
-		return "", fmt.Errorf("cluster doesn't have a follower")
+		return "", errors.New("cluster doesn't have a follower")
 	}

 	return remote, nil
@@ -63,68 +63,61 @@ func CcrFollowerRenew(conf *cfg.Config, index string) error {
 	if err := wrapError(IndexClose, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("closed %s", index)

 	if err := wrapError(CcrFollowerPause, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("paused %s", index)

 	if err := wrapError(CcrFollowerUnfollow, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("unfollowed %s", index)

 	if err := wrapError(IndexDelete, conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("deleted %s", index)

 	if err := CcrFollowerAdd(conf, index); err != nil {
 		return err
 	}
+
 	fmt.Printf("added follower %s", index)

 	return nil
 }

 func CcrFollowerResume(conf *cfg.Config, index string) error {
-	create := conf.DefaultCluster.ES.Ccr.ResumeFollow(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
-
-	_, err := create.Do(context.Background())
-
+	_, err := conf.DefaultCluster.ES().Ccr.ResumeFollow(index).
+		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to resume ccr following: %s", esErrorString(err))
+		return fmt.Errorf("failed to resume ccr following: %w", esErrorString(err))
 	}

 	return nil
 }

 func CcrFollowerPause(conf *cfg.Config, index string) error {
-	create := conf.DefaultCluster.ES.Ccr.PauseFollow(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
-
-	_, err := create.Do(context.Background())
-
+	_, err := conf.DefaultCluster.ES().Ccr.PauseFollow(index).
+		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to pause ccr following: %s", esErrorString(err))
+		return fmt.Errorf("failed to pause ccr following: %w", esErrorString(err))
 	}

 	return nil
 }

 func CcrFollowerUnfollow(conf *cfg.Config, index string) error {
-	create := conf.DefaultCluster.ES.Ccr.ForgetFollower(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
-
-	_, err := create.Do(context.Background())
-
+	_, err := conf.DefaultCluster.ES().Ccr.ForgetFollower(index).
+		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to unfollow index: %s", esErrorString(err))
+		return fmt.Errorf("failed to unfollow index: %w", esErrorString(err))
 	}

 	return nil
@@ -136,32 +129,27 @@ func CcrFollowerAdd(conf *cfg.Config, index string) error {
 		return err
 	}

-	create := conf.DefaultCluster.ES.Ccr.Follow(index).
+	create := conf.DefaultCluster.ES().Ccr.Follow(index).
 		LeaderIndex(index).
-		RemoteCluster(remote).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
+		RemoteCluster(remote)

 	if conf.Wait {
 		create.WaitForActiveShards("all")
 	}

 	_, err = create.Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create follower index: %s", esErrorString(err))
+		return fmt.Errorf("failed to create follower index: %w", esErrorString(err))
 	}

 	return nil
 }

 func CcrFollowerShow(conf *cfg.Config, index string) error {
-	res, err := conf.DefaultCluster.ES.Ccr.FollowStats(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Ccr.FollowStats(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve follower index info: %s", esErrorString(err))
+		return fmt.Errorf("failed to retrieve follower index info: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "follower stats", res.Indices)
@@ -179,16 +167,16 @@ func CcrFollowerShow(conf *cfg.Config, index string) error {
 	table := printer.NewTable(conf, 2, 9)
 	table.Addheaders("ccr follower property", "value")

-	table.Entries = [][]string{
+	table.Entries = [][]any{
 		{"name", index},
 		{"remote_cluster", follower.RemoteCluster},
-		{"leader_checkpoint", fmt.Sprintf("%d", follower.LeaderGlobalCheckpoint)},
-		{"follower_checkpoint", fmt.Sprintf("%d", follower.FollowerGlobalCheckpoint)},
-		{"bytes_read", fmt.Sprintf("%d", follower.BytesRead)},
-		{"failed_read_requests", fmt.Sprintf("%d", follower.FailedReadRequests)},
-		{"failed_write_requests", fmt.Sprintf("%d", follower.FailedWriteRequests)},
-		{"successful_read_requests", fmt.Sprintf("%d", follower.SuccessfulReadRequests)},
-		{"successful_write_requests", fmt.Sprintf("%d", follower.SuccessfulWriteRequests)},
+		{"leader_checkpoint", follower.LeaderGlobalCheckpoint},
+		{"follower_checkpoint", follower.FollowerGlobalCheckpoint},
+		{"bytes_read", follower.BytesRead},
+		{"failed_read_requests", follower.FailedReadRequests},
+		{"failed_write_requests", follower.FailedWriteRequests},
+		{"successful_read_requests", follower.SuccessfulReadRequests},
+		{"successful_write_requests", follower.SuccessfulWriteRequests},
 	}

 	if err := table.Print(); err != nil {
--- a/pkg/es/cluser_health_report.go
+++ b/pkg/es/cluser_health_report.go
@@ -0,0 +1,59 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+)
+
+type HealthReport struct {
+	Indicators map[string]HealthReportIndicator
+}
+
+type HealthReportIndicator struct {
+	Status, Symptom string
+	Diagnosis       []HealthReportDiagnosis
+}
+
+type HealthReportDiagnosis struct {
+	Id, Cause, Action string
+	AffectedResources map[string][]string `json:"affected_resources"`
+}
+
+// we do not use the go-elasticsearch  client API here but call the ES
+// API    directly,     because    the    returned     structure    (a
+// healthreport.Response) is  not iterable,  you'd have  to explicitly
+// call  every indicator  type and  every  cause etc  which also  have
+// different types  each. To check which  is !green would result  in a
+// gigantic function.
+func getHealthReport(conf *cfg.Config) (*HealthReport, error) {
+	raw, err := CallAPI(conf, "GET", "/_health_report", "")
+	if err != nil {
+		return nil, err
+	}
+
+	report := HealthReport{}
+
+	if err := json.Unmarshal(raw, &report); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal healthreport response: %w", err)
+	}
+
+	return &report, nil
+}
--- a/pkg/es/cluster.go
+++ b/pkg/es/cluster.go
@@ -17,76 +17,235 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package es

 import (
-	"context"
+	"errors"
 	"fmt"
 	"log/slog"
-	"slices"
 	"strings"
 	"sync"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/dustin/go-humanize"
-	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
-	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/tasks"
-	"github.com/elastic/go-elasticsearch/v9/typedapi/ccr/stats"
-	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
 	clusterstats "github.com/elastic/go-elasticsearch/v9/typedapi/cluster/stats"
-	"github.com/elastic/go-elasticsearch/v9/typedapi/core/info"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )

-const (
-	ResponseHealth = iota
-	ResponseInfo
-	ResponseCcr
-	ResponseStats
-	ResponseIndices
-	ResponseTasks
-)
-
 type ClusterIndices map[string]map[string]*types.IndicesRecord

-type apiResponse struct {
-	error   error
-	info    *info.Response
-	health  *health.Response
-	ccr     *stats.Response
-	stats   *clusterstats.Response
-	indices *indices.Response
-	tasks   *tasks.Response
-	which   int
+type clusterReachable struct {
+	reachable bool
+	err       error
 }

 func ClusterList(conf *cfg.Config) error {
-	table := printer.NewTable(conf, 3, len(conf.Clusters))
+	var (
+		mu sync.Mutex
+		wg sync.WaitGroup
+	)

-	table.Addheaders("cluster", "uri", "default")
+	reachable := make(map[string]clusterReachable, len(conf.Clusters))
+
+	// check endpoints in parallel to speed things up
+	for name, cluster := range conf.Clusters {
+		wg.Go(func() {
+			online, err := cluster.IsReachable()
+
+			mu.Lock()
+			reachable[name] = clusterReachable{reachable: online, err: err}
+			mu.Unlock()
+		})
+	}
+
+	wg.Wait()
+
+	table := printer.NewTable(conf, 5, len(conf.Clusters))
+	table.Addheaders("cluster", "uri", "reachable", "current", "error")

 	idx := 0

-	names := make([]string, len(conf.Clusters))
-	for name := range conf.Clusters {
-		names[idx] = name
+	for name, cluster := range conf.Clusters {
+		reachableStr := "no"
+		current := "no"
+		errmsg := ""
+
+		if reachable[name].reachable {
+			reachableStr = printer.Colorize(conf, "green", "reachable")
+		}
+
+		if cluster.Default {
+			current = printer.Colorize(conf, "green", "yes")
+
+			if !reachable[name].reachable {
+				reachableStr = printer.Colorize(conf, "red", "no")
+				errmsg = reachable[name].err.Error()
+			}
+		}
+
+		table.Entries[idx] = []any{name, cluster.Uri, reachableStr, current, errmsg}
 		idx++
 	}

-	slices.Sort(names)
+	table.Sort()

-	for idx, name := range names {
-		current := name == "default" || name == conf.CurrentCluster
-		cluster := conf.Clusters[name]
+	return table.Print()
+}

-		_, err := cluster.ES.Cluster.Health().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
-			Do(context.Background())
+// We're using goroutines  here to parallelize API  requests, since we
+// have to do 3 of'em for each cluster. This speeds things up.
+func getClusterStatus(conf *cfg.Config) (*apiResponse, error) {
+	gocount := 6
+	if conf.Verbose {
+		gocount++
+	}

-		if err == nil {
-			name = printer.Colorize(conf, "green", name)
+	es := conf.DefaultCluster.ES()
+
+	responses := make(chan apiResponse, gocount)
+	wg := &sync.WaitGroup{}
+
+	wg.Add(gocount)
+	go getApiData(conf, es, wg, responses, "health")
+	go getApiData(conf, es, wg, responses, "healthreport")
+	go getApiData(conf, es, wg, responses, "info")
+	go getApiData(conf, es, wg, responses, "ccr")
+	go getApiData(conf, es, wg, responses, "indices")
+	go getApiData(conf, es, wg, responses, "tasks")
+
+	if conf.Verbose {
+		go getApiData(conf, es, wg, responses, "stats")
+	}
+
+	wg.Wait()
+
+	all := apiResponse{}
+
+	var err error
+
+	for range gocount {
+		res := <-responses
+
+		err = errors.Join(err, res.error)
+
+		switch res.which {
+		case ResponseHealth:
+			all.health = res.health
+		case ResponseCcr:
+			all.ccr = res.ccr
+		case ResponseInfo:
+			all.info = res.info
+		case ResponseStats:
+			all.stats = res.stats
+		case ResponseIndices:
+			all.indices = res.indices
+		case ResponseTasks:
+			all.tasks = res.tasks
+		case ResponseHealthReport:
+			all.healthreport = res.healthreport
 		}
+	}

-		table.Entries[idx] = []string{name, cluster.Uri, fmt.Sprintf("%t", current)}
+	return &all, err
+}
+
+func ClusterStatus(conf *cfg.Config) error {
+	res, err := getClusterStatus(conf)
+	if err != nil && !strings.Contains(err.Error(), "current license is non-compliant") {
+		return err
+	}
+
+	slog.Debug("ES result", "cluster health", res.health)
+
+	var (
+		isleader     bool
+		ccrfollowing string
+	)
+
+	if res.ccr != nil {
+		isleader = len(res.ccr.AutoFollowStats.AutoFollowedClusters) == 0
+
+		if len(res.ccr.AutoFollowStats.AutoFollowedClusters) > 0 {
+			// is following another cluster
+			ccrfollowing = fmt.Sprintf("%s (%d/%d)",
+				res.ccr.AutoFollowStats.AutoFollowedClusters[0].ClusterName,
+				res.ccr.AutoFollowStats.NumberOfSuccessfulFollowIndices,
+				res.ccr.AutoFollowStats.NumberOfFailedFollowIndices,
+			)
+		}
+	}
+
+	// look for red indices, if any
+	failedIndices := 0
+	greenIndices := 0
+
+	for _, index := range *res.indices {
+		switch {
+		case *index.Health != "green":
+			failedIndices++
+		case !strings.HasPrefix(*index.Index, "."):
+			// don't count internal indices
+			greenIndices++
+		}
+	}
+
+	// look for long running tasks
+	longtasks := 0
+
+	for _, task := range *res.tasks {
+		if strings.Contains(*task.RunningTime, "d") {
+			longtasks++
+		}
+	}
+
+	table := printer.NewTable(conf, 2, 7)
+	table.Addheaders(conf.DefaultCluster.Name, "status")
+
+	table.Entries = [][]any{
+		{"Cluster Name", res.health.ClusterName},
+		{"ES Status", printer.Colorize(conf, res.health.Status.Name, res.health.Status.Name)},
+		{"ES Version", res.info.Version.Int},
+		{"Is Leader", isleader},
+		{"Active Shards", res.health.ActiveShards},
+		{"Active Primary Shards", res.health.ActivePrimaryShards},
+		{"Unassigned Shards", res.health.UnassignedShards},
+		{"Unassigned Primary Shards", res.health.UnassignedPrimaryShards},
+		{"Pending Tasks", res.health.NumberOfPendingTasks},
+		{"Nodes", res.health.NumberOfNodes},
+		{"Green Indices", greenIndices},
+		{"Failed Indices", failedIndices},
+		{"Long Running Tasks", longtasks},
+	}
+
+	if !isleader && res.ccr != nil {
+		table.Entries = append(table.Entries, [][]any{
+			{"AutoFollow (success/failed indices)", ccrfollowing},
+			{"Followed Indices", len(res.ccr.FollowStats.Indices)},
+		}...)
+	}
+
+	if conf.Verbose {
+		table = gatherClusterStats(res.stats, table)
+	}
+
+	if res.health.Status.Name != "green" {
+		for name, indicator := range res.healthreport.Indicators {
+			if indicator.Status != "green" {
+				table.Entries = append(table.Entries, []any{
+					printer.Colorize(conf, indicator.Status, "Bad health "+name), indicator.Symptom,
+				})
+
+				for _, diag := range indicator.Diagnosis {
+					table.Entries = append(table.Entries, []any{" -> cause", diag.Cause})
+
+					for resource, items := range diag.AffectedResources {
+						table.Entries = append(table.Entries, []any{"    -> affected " + resource, strings.Join(items, ",")})
+					}
+
+					if diag.Action != "" {
+						table.AddRow("        -> suggested action to fix", diag.Action)
+					}
+				}
+			}
+		}
 	}

 	if err := table.Print(); err != nil {
@@ -96,145 +255,11 @@ func ClusterList(conf *cfg.Config) error {
 	return nil
 }

-// We're using goroutines  here to parallelize API  requests, since we
-// have to do 3 of'em for each cluster. This speeds things up.
-func ClusterStatus(conf *cfg.Config) error {
-	clusters := []string{}
-	gocount := 5
-	if conf.Verbose {
-		gocount++
-	}
-
-	if conf.All {
-		for key := range conf.Clusters {
-			clusters = append(clusters, key)
-		}
-	} else {
-		clusters = []string{"default"}
-	}
-
-	for _, cluster := range clusters {
-		es := conf.DefaultCluster.ES
-		if cluster != "default" {
-			es = conf.Clusters[cluster].ES
-		}
-
-		responses := make(chan apiResponse, gocount)
-		wg := &sync.WaitGroup{}
-
-		wg.Add(gocount)
-		go getClusterData(es, wg, responses, "health")
-		go getClusterData(es, wg, responses, "info")
-		go getClusterData(es, wg, responses, "ccrstats")
-		go getClusterData(es, wg, responses, "indices")
-		go getClusterData(es, wg, responses, "tasks")
-
-		if conf.Verbose {
-			go getClusterData(es, wg, responses, "stats")
-		}
-
-		wg.Wait()
-
-		var clusterhealth *health.Response
-		var info *info.Response
-		var ccrstats *stats.Response
-		var clusterstats *clusterstats.Response
-		var indexstats *indices.Response
-		var taskstatus *tasks.Response
-
-		for i := 0; i < gocount; i++ {
-			r := <-responses
-
-			if r.error != nil {
-				return r.error
-			}
-
-			switch r.which {
-			case ResponseHealth:
-				clusterhealth = r.health
-			case ResponseCcr:
-				ccrstats = r.ccr
-			case ResponseInfo:
-				info = r.info
-			case ResponseStats:
-				clusterstats = r.stats
-			case ResponseIndices:
-				indexstats = r.indices
-			case ResponseTasks:
-				taskstatus = r.tasks
-			}
-		}
-
-		slog.Debug("ES result", "cluster health", clusterhealth)
-
-		isleader := len(ccrstats.AutoFollowStats.AutoFollowedClusters) == 0
-
-		ccrfollowing := ""
-		if len(ccrstats.AutoFollowStats.AutoFollowedClusters) > 0 {
-			// is following another cluster
-			ccrfollowing = fmt.Sprintf("%s (%d/%d)",
-				ccrstats.AutoFollowStats.AutoFollowedClusters[0].ClusterName,
-				ccrstats.AutoFollowStats.NumberOfSuccessfulFollowIndices,
-				ccrstats.AutoFollowStats.NumberOfFailedFollowIndices,
-			)
-		}
-
-		// look for red indices, if any
-		redindices := 0
-		for _, index := range *indexstats {
-			if *index.Health == "red" {
-				redindices++
-			}
-		}
-
-		// look for long running tasks
-		longtasks := 0
-		for _, task := range *taskstatus {
-			if strings.Contains(*task.RunningTime, "d") {
-				longtasks++
-			}
-		}
-
-		table := printer.NewTable(conf, 2, 7)
-		table.Addheaders(cluster, "status")
-
-		table.Entries = [][]string{
-			{"Cluster Name", clusterhealth.ClusterName},
-			{"ES Status", printer.Colorize(conf, clusterhealth.Status.Name, clusterhealth.Status.Name)},
-			{"ES Version", info.Version.Int},
-			{"Is Leader", fmt.Sprintf("%t", isleader)},
-			{"Active Shards", fmt.Sprintf("%d", clusterhealth.ActiveShards)},
-			{"Active Primary Shards", fmt.Sprintf("%d", clusterhealth.ActivePrimaryShards)},
-			{"Unassigned Shards", fmt.Sprintf("%d", clusterhealth.UnassignedShards)},
-			{"Unassigned Primary Shards", fmt.Sprintf("%d", clusterhealth.UnassignedPrimaryShards)},
-			{"Pending Tasks", fmt.Sprintf("%d", clusterhealth.NumberOfPendingTasks)},
-			{"Nodes", fmt.Sprintf("%d", clusterhealth.NumberOfNodes)},
-			{"Red Indices", fmt.Sprintf("%d", redindices)},
-			{"Long Running Tasks", fmt.Sprintf("%d", longtasks)},
-		}
-
-		if !isleader {
-			table.Entries = append(table.Entries, [][]string{
-				{"AutoFollow (success/failed indices)", ccrfollowing},
-				{"Followed Indices", fmt.Sprintf("%d", len(ccrstats.FollowStats.Indices))},
-			}...)
-		}
-
-		if conf.Verbose {
-			table = gatherClusterStats(conf, clusterstats, table)
-		}
-
-		if err := table.Print(); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func gatherClusterStats(conf *cfg.Config, clusterstats *clusterstats.Response, table *printer.Table) *printer.Table {
-	var querycount int64
-	var vmversion string
+func gatherClusterStats(clusterstats *clusterstats.Response, table *printer.Table) *printer.Table {
+	var (
+		querycount int64
+		vmversion  string
+	)

 	for _, count := range clusterstats.Indices.Search.Queries {
 		querycount += count
@@ -246,13 +271,13 @@ func gatherClusterStats(conf *cfg.Config, clusterstats *clusterstats.Response, t
 			clusterstats.Nodes.Jvm.Versions[0].VmVersion}, " ")
 	}

-	table.Entries = append(table.Entries, [][]string{
-		{"Indicies", fmt.Sprintf("%d", clusterstats.Indices.Count)},
-		{"Docs", fmt.Sprintf("%d", clusterstats.Indices.Docs.Count)},
-		{"Total Size", humanize.Bytes(uint64(clusterstats.Indices.Docs.TotalSizeInBytes))},
-		{"Total Queries", fmt.Sprintf("%d", querycount)},
-		{"Shards Primaries", fmt.Sprintf("%d", clusterstats.Indices.Shards.Primaries)},
-		{"Shards Total", fmt.Sprintf("%d", clusterstats.Indices.Shards.Total)},
+	table.Entries = append(table.Entries, [][]any{
+		{"Indicies", clusterstats.Indices.Count},
+		{"Docs", clusterstats.Indices.Docs.Count},
+		{"Total Size", printer.Bytes(clusterstats.Indices.Docs.TotalSizeInBytes)},
+		{"Total Queries", "%d", querycount},
+		{"Shards Primaries", clusterstats.Indices.Shards.Primaries},
+		{"Shards Total", clusterstats.Indices.Shards.Total},
 		{"Storage", fmt.Sprintf(
 			"%s/%s",
 			humanize.Bytes(uint64(clusterstats.Indices.Store.SizeInBytes)),
@@ -263,11 +288,11 @@ func gatherClusterStats(conf *cfg.Config, clusterstats *clusterstats.Response, t
 			humanize.Bytes(uint64(clusterstats.Nodes.Jvm.Mem.HeapUsedInBytes)),
 			humanize.Bytes(uint64(clusterstats.Nodes.Jvm.Mem.HeapMaxInBytes)),
 		)},
-		{"JVM Threads", fmt.Sprintf("%d", clusterstats.Nodes.Jvm.Threads)},
+		{"JVM Threads", clusterstats.Nodes.Jvm.Threads},
 		{"JVM Version", vmversion},
-		{"CPUs", fmt.Sprintf("%d", clusterstats.Nodes.Os.AllocatedProcessors)},
+		{"CPUs", clusterstats.Nodes.Os.AllocatedProcessors},
 		{"CPU Usage", fmt.Sprintf("%d%%", clusterstats.Nodes.Process.Cpu.Percent)},
-		{"Open FDs", fmt.Sprintf("%d", clusterstats.Nodes.Process.OpenFileDescriptors.Avg)},
+		{"Open FDs", clusterstats.Nodes.Process.OpenFileDescriptors.Avg},
 	}...)

 	return table
--- a/pkg/es/cluster_reroute.go
+++ b/pkg/es/cluster_reroute.go
@@ -0,0 +1,126 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"fmt"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+)
+
+func ClusterRerouteMove(conf *cfg.Config, index string) error {
+	move := conf.DefaultCluster.ES().Cluster.Reroute()
+
+	commands := esdsl.NewCommand()
+	moveCommand := &types.CommandMoveAction{
+		Shard:    conf.Shards,
+		FromNode: conf.FromNode,
+		ToNode:   conf.ToNode,
+		Index:    index,
+	}
+
+	commands.CommandCaster().Move = moveCommand
+
+	move.Commands(commands)
+
+	_, err := move.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to reroute move: %w", err)
+	}
+
+	return nil
+}
+
+func ClusterRerouteAllocateReplica(conf *cfg.Config, index string) error {
+	move := conf.DefaultCluster.ES().Cluster.Reroute()
+
+	commands := esdsl.NewCommand()
+	allocCommand := &types.CommandAllocateReplicaAction{
+		Shard: conf.Shards,
+		Node:  conf.ToNode,
+		Index: index,
+	}
+
+	commands.CommandCaster().AllocateReplica = allocCommand
+
+	move.Commands(commands)
+
+	_, err := move.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to allocate a replica shard: %w", err)
+	}
+
+	return nil
+}
+
+func ClusterRerouteCancel(conf *cfg.Config, index string) error {
+	move := conf.DefaultCluster.ES().Cluster.Reroute()
+
+	commands := esdsl.NewCommand()
+	cancelCommand := &types.CommandCancelAction{
+		Shard:        conf.Shards,
+		Node:         conf.ToNode,
+		Index:        index,
+		AllowPrimary: &conf.AllowPrimary,
+	}
+
+	commands.CommandCaster().Cancel = cancelCommand
+
+	move.Commands(commands)
+
+	_, err := move.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to cancel a reroute process: %w", err)
+	}
+
+	return nil
+}
+
+func ClusterRerouteAllocatePrimary(conf *cfg.Config, index string, stale bool) error {
+	move := conf.DefaultCluster.ES().Cluster.Reroute()
+
+	commands := esdsl.NewCommand()
+	allocCommand := &types.CommandAllocatePrimaryAction{
+		Shard:          conf.Shards,
+		Node:           conf.ToNode,
+		Index:          index,
+		AcceptDataLoss: conf.AcceptDataLoss,
+	}
+
+	if stale {
+		commands.CommandCaster().AllocateStalePrimary = allocCommand
+	} else {
+		commands.CommandCaster().AllocateEmptyPrimary = allocCommand
+	}
+
+	move.Commands(commands)
+
+	_, err := move.Do(context.Background())
+	if err != nil {
+		which := "empty"
+		if stale {
+			which = "stale"
+		}
+
+		return fmt.Errorf("failed to allocate %s primary shard: %w", which, err)
+	}
+
+	return nil
+}
--- a/pkg/es/cluster_settings.go
+++ b/pkg/es/cluster_settings.go
@@ -20,25 +20,28 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"log/slog"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/urfave/cli/v3"
 )

+func ClusterSettingsNames(conf *cfg.Config) ([]string, error) {
+	return validClusterSettings, nil
+}
+
 func ClusterSettingsList(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Cluster.GetSettings().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Cluster.GetSettings().
+		FlatSettings(true).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get cluster settings: %s", esErrorString(err))
+		return fmt.Errorf("failed to get cluster settings: %w", esErrorString(err))
 	}

 	table := printer.NewTable(conf, 2, 0)
 	table.Addheaders("setting", "value")
-	entries := [][]string{}
+
+	entries := [][]any{}

 	settingshash := res.Persistent // == map[string]json.RawMessage

@@ -50,19 +53,7 @@ func ClusterSettingsList(conf *cfg.Config) error {
 	}

 	for topic, val := range settingshash {
-		data := map[string]any{}
-
-		err := json.Unmarshal(val, &data)
-		if err != nil {
-			return fmt.Errorf("failed to unmarshall setting for topic %s: %s", topic, err)
-		}
-
-		paths := getJsonPath(map[string]string{}, data, topic)
-		slog.Debug("settings", topic, paths)
-
-		for setting, value := range paths {
-			entries = append(entries, []string{setting, fmt.Sprintf("%v", value)})
-		}
+		entries = append(entries, []any{topic, string(val)})
 	}

 	table.Entries = entries
@@ -76,7 +67,7 @@ func ClusterSettingsList(conf *cfg.Config) error {
 }

 func ClusterSettingsSet(conf *cfg.Config, args cli.Args) error {
-	put := conf.Clusters[conf.CurrentCluster].ES.Cluster.PutSettings()
+	put := conf.DefaultCluster.ES().Cluster.PutSettings()

 	for _, arg := range args.Slice() {
 		setting, value := splitArg(arg)
@@ -85,27 +76,25 @@ func ClusterSettingsSet(conf *cfg.Config, args cli.Args) error {
 		case conf.Transient:
 			message, err := json.Marshal(value)
 			if err != nil {
-				return fmt.Errorf("failed to marshall transient value <%v> to valid JSON: %s", value, err)
+				return fmt.Errorf("failed to marshall transient value <%v> to valid JSON: %w", value, err)
 			}
+
 			put.AddTransient(setting, message)
 		case conf.Persistent:
 			fallthrough
 		default:
 			message, err := json.Marshal(value)
 			if err != nil {
-				return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %s", value, err)
+				return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %w", value, err)
 			}
+
 			put.AddPersistent(setting, message)
 		}
 	}

-	_, err := put.
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
-		Do(context.Background())
-
+	_, err := put.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to set settings: %s", esErrorString(err))
+		return fmt.Errorf("failed to set settings: %w", esErrorString(err))
 	}

 	return nil
@@ -114,17 +103,14 @@ func ClusterSettingsSet(conf *cfg.Config, args cli.Args) error {
 func ClusterSettingsSetSingle(conf *cfg.Config, setting, value string) error {
 	message, err := json.Marshal(value)
 	if err != nil {
-		return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %s", value, err)
+		return fmt.Errorf("failed to marshall persistent value <%v> to valid JSON: %w", value, err)
 	}

-	_, err = conf.Clusters[conf.CurrentCluster].ES.Cluster.PutSettings().
+	_, err = conf.DefaultCluster.ES().Cluster.PutSettings().
 		AddPersistent(setting, message).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to set %s: %s", setting, esErrorString(err))
+		return fmt.Errorf("failed to set %s: %w", setting, esErrorString(err))
 	}

 	return nil
--- a/pkg/es/cluster_settings_const.go
+++ b/pkg/es/cluster_settings_const.go
@@ -0,0 +1,730 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+// manually extracted from https://www.elastic.co/docs/reference/elasticsearch/configuration-reference
+
+var validClusterSettings []string = []string{
+	"action.auto_create_index",
+	"action.destructive_requires_name",
+	"attribute_delimiters.groups",
+	"attribute_patterns.dn",
+	"attribute_patterns.groups",
+	"attribute_patterns.mail",
+	"attribute_patterns.name",
+	"attribute_patterns.principal",
+	"attributes.dn",
+	"attributes.groups",
+	"attributes.mail",
+	"attributes.name",
+	"attributes.principal",
+	"authentication.enabled",
+	"auth.secure_password",
+	"auth.username",
+	"breaker.eql_sequence.limit",
+	"breaker.eql_sequence.overhead",
+	"breaker.eql_sequence.type",
+	"breaker.model_inference.limit",
+	"breaker.model_inference.overhead",
+	"breaker.model_inference.type",
+	"cache.hash_algo",
+	"cache.max_users",
+	"cache.ttl",
+	"ccr.indices.recovery.chunk_size",
+	"ccr.indices.recovery.internal_action_timeout",
+	"ccr.indices.recovery.max_bytes_per_sec",
+	"ccr.indices.recovery.max_concurrent_file_chunks",
+	"ccr.indices.recovery.recovery_activity_timeout",
+	"claim_patterns.dn",
+	"claim_patterns.group",
+	"claim_patterns.groups",
+	"claim_patterns.mail",
+	"claim_patterns.name",
+	"claim_patterns.principal",
+	"claims.dn",
+	"claims.groups",
+	"claims.mail",
+	"claims.name",
+	"claims.principal",
+	"client_authentication.rotation_grace_period",
+	"client_authentication.shared_secret",
+	"client_authentication.type",
+	"cluster_alerts.management.blacklist",
+	"cluster_alerts.management.enabled",
+	"cluster.auto_shrink_voting_configuration",
+	"cluster.discovery_configuration_check.interval",
+	"cluster.election.duration",
+	"cluster.election.initial_timeout",
+	"cluster.election.max_timeout",
+	"cluster.fault_detection.follower_check.retry_count",
+	"cluster.fault_detection.follower_check.timeout",
+	"cluster.fault_detection.leader_check.interval",
+	"cluster.fault_detection.leader_check.retry_count",
+	"cluster.fault_detection.leader_check.timeout",
+	"cluster.follower_lag.timeout",
+	"cluster.indices.close.enable",
+	"cluster.info.update.interval",
+	"cluster.initial_master_nodes",
+	"cluster.join_validation.cache_timeout",
+	"cluster.lifecycle.default.rollover",
+	"cluster.max_voting_config_exclusions",
+	"cluster.no_master_block",
+	"cluster.publish.info_timeout",
+	"cluster.publish.timeout",
+	"cluster.reindex.pit.keep_alive",
+	"cluster.remote.initial_connect_timeout",
+	"cluster.remote.node.attr",
+	"cluster.remote.signing.certificate_authorities",
+	"cluster.remote.signing.diagnose.trust",
+	"cluster.remote.signing.truststore.algorithm",
+	"cluster.remote.signing.truststore.path",
+	"cluster.remote.signing.truststore.secure_password",
+	"cluster.remote.signing.truststore.type",
+	"cluster.routing.allocation.allow_rebalance",
+	"cluster.routing.allocation.awareness.attributes",
+	"cluster.routing.allocation.awareness.force.*",
+	"cluster.routing.allocation.balance.disk_usage",
+	"cluster.routing.allocation.balance.index",
+	"cluster.routing.allocation.balance.shard",
+	"cluster.routing.allocation.balance.threshold",
+	"cluster.routing.allocation.balance.write_load",
+	"cluster.routing.allocation.cluster_concurrent_rebalance",
+	"cluster.routing.allocation.disk.threshold_enabled",
+	"cluster.routing.allocation.disk.watermark.enable_for_single_data_node",
+	"cluster.routing.allocation.disk.watermark.flood_stage",
+	"cluster.routing.allocation.disk.watermark.flood_stage.frozen",
+	"cluster.routing.allocation.disk.watermark.flood_stage.frozen.max_headroom",
+	"cluster.routing.allocation.disk.watermark.flood_stage.max_headroom",
+	"cluster.routing.allocation.disk.watermark.high",
+	"cluster.routing.allocation.disk.watermark.high.max_headroom",
+	"cluster.routing.allocation.disk.watermark.low",
+	"cluster.routing.allocation.disk.watermark.low.max_headroom",
+	"cluster.routing.allocation.enable",
+	"cluster.routing.allocation.exclude.{{attribute}}",
+	"cluster.routing.allocation.include.{{attribute}}",
+	"cluster.routing.allocation.node_concurrent_incoming_recoveries",
+	"cluster.routing.allocation.node_concurrent_outgoing_recoveries",
+	"cluster.routing.allocation.node_concurrent_recoveries",
+	"cluster.routing.allocation.node_initial_primaries_recoveries",
+	"cluster.routing.allocation.require.{{attribute}}",
+	"cluster.routing.allocation.same_shard.host",
+	"cluster.routing.allocation.stats.cache.ttl",
+	"cluster.routing.allocation.total_shards_per_node",
+	"cluster.routing.allocation.type",
+	"cluster.routing.rebalance.enable",
+	"connection.read_timeout",
+	"connection.timeout",
+	"data_streams.lifecycle.downsampling.max_indices_in_progress",
+	"data_streams.lifecycle.poll_interval",
+	"data_streams.lifecycle.retention.default",
+	"data_streams.lifecycle.retention.max",
+	"data_streams.lifecycle.signalling.error_retry_interval",
+	"data_streams.lifecycle.target.merge.policy.floor_segment",
+	"data_streams.lifecycle.target.merge.policy.merge_factor",
+	"delegation.enabled",
+	"discovery.cluster_formation_warning_timeout",
+	"discovery.find_peers_interval",
+	"discovery.find_peers_warning_timeout",
+	"discovery.probe.connect_timeout",
+	"discovery.probe.handshake_timeout",
+	"discovery.request_peers_timeout",
+	"discovery.seed_hosts",
+	"discovery.seed_providers",
+	"discovery.seed_resolver.max_concurrent_resolvers",
+	"discovery.seed_resolver.timeout",
+	"discovery.type",
+	"dlm.frozen.cleanup.poll_interval",
+	"dlm.frozen.transition.poll_interval",
+	"dlm.frozen.transition.thread_pool.queue_size",
+	"dlm.frozen.transition.thread_pool.size",
+	"email_defaults.*",
+	"encryption.certificate",
+	"encryption.key",
+	"encryption.keystore.alias",
+	"encryption.keystore.path",
+	"encryption.keystore.secure_key_password",
+	"encryption.keystore.secure_password",
+	"encryption.keystore.type",
+	"encryption.secure_key_passphrase",
+	"enrich.cache_size",
+	"enrich.cleanup_period",
+	"enrich.coordinator_proxy.max_concurrent_requests",
+	"enrich.coordinator_proxy.max_lookups_per_request",
+	"enrich.coordinator_proxy.queue_capacity",
+	"enrich.fetch_size",
+	"enrich.max_concurrent_policy_executions",
+	"enrich.max_force_merge_attempts",
+	"fallback_claims.aud",
+	"fallback_claims.sub",
+	"files.role_mapping",
+	"gateway.expected_data_nodes",
+	"gateway.recover_after_data_nodes",
+	"gateway.recover_after_time",
+	"group_search.base_dn",
+	"group_search.filter",
+	"group_search.scope",
+	"group_search.user_attribute",
+	"health.ilm.max_retries_per_step",
+	"health.ilm.max_time_on_action",
+	"health.ilm.max_time_on_step",
+	"health.master_history.has_master_lookup_timeframe",
+	"health.master_history.identity_changes_threshold",
+	"health.master_history.no_master_transitions_threshold",
+	"health.node.enabled",
+	"health.periodic_logger.enabled",
+	"health.periodic_logger.poll_interval",
+	"health.reporting.local.monitor.interval",
+	"health.shard_capacity.unhealthy_threshold.red",
+	"health.shard_capacity.unhealthy_threshold.yellow",
+	"http.bind_host",
+	"http.client_stats.closed_channels.max_age",
+	"http.client_stats.closed_channels.max_count",
+	"http.client_stats.enabled",
+	"http.compression",
+	"http.compression_level",
+	"http.connection_pool_ttl",
+	"http.connection_read_timeout",
+	"http.connect_timeout",
+	"http.cors.enabled",
+	"http.detailed_errors.enabled",
+	"http.host",
+	"http.max_connections",
+	"http.max_content_length",
+	"http.max_endpoint_connections",
+	"http.max_header_size",
+	"http.max_initial_line_length",
+	"http.max_warning_header_count",
+	"http.max_warning_header_size",
+	"http.pipelining.max_events",
+	"http.port",
+	"http.proxy.host",
+	"http.proxy.port",
+	"http.proxy.scheme",
+	"http.publish_host",
+	"http.publish_port",
+	"http.socket_timeout",
+	"http.tcp.keep_alive",
+	"http.tcp.keep_count",
+	"http.tcp.keep_idle",
+	"http.tcp.keep_interval",
+	"http.tcp.no_delay",
+	"http.tcp.receive_buffer_size",
+	"http.tcp.reuse_address",
+	"http.tcp.send_buffer_size",
+	"idp.entity_id",
+	"idp.metadata.http.connect_timeout",
+	"idp.metadata.http.fail_on_error",
+	"idp.metadata.http.minimum_refresh",
+	"idp.metadata.http.read_timeout",
+	"idp.metadata.http.refresh",
+	"idp.metadata.path",
+	"idp.use_single_logout",
+	"index.dlm.frozen.created",
+	"indexing_pressure.memory.limit",
+	"index.lifecycle.indexing_complete",
+	"index.lifecycle.name",
+	"index.lifecycle.origination_date",
+	"index.lifecycle.parse_origination_date",
+	"index.lifecycle.prefer_ilm",
+	"index.lifecycle.rollover_alias",
+	"index.lifecycle.step.wait_time_threshold",
+	"index.name.time_format",
+	"index.queries.cache.enabled",
+	"indices.breaker.fielddata.limit",
+	"indices.breaker.fielddata.overhead",
+	"indices.breaker.request.limit",
+	"indices.breaker.request.overhead",
+	"indices.breaker.total.limit",
+	"indices.breaker.total.use_real_memory",
+	"indices.fielddata.cache.size",
+	"indices.lifecycle.history_index_enabled",
+	"indices.lifecycle.poll_interval",
+	"indices.lifecycle.rollover.only_if_has_documents",
+	"indices.memory.index_buffer_size",
+	"indices.memory.max_index_buffer_size",
+	"indices.memory.min_index_buffer_size",
+	"indices.queries.cache.size",
+	"indices.query.bool.max_clause_count",
+	"indices.query.bool.max_nested_depth",
+	"indices.recovery.max_bytes_per_sec",
+	"indices.recovery.max_concurrent_file_chunks",
+	"indices.recovery.max_concurrent_operations",
+	"indices.recovery.max_concurrent_snapshot_file_downloads",
+	"indices.recovery.max_concurrent_snapshot_file_downloads_per_node",
+	"indices.recovery.use_snapshots",
+	"indices.requests.cache.expire",
+	"indices.requests.cache.size",
+	"jwt.cache.size",
+	"jwt.cache.ttl",
+	"keytab.path",
+	"krb.debug",
+	"load_balance.cache_ttl",
+	"load_balance.type",
+	"master_history.max_age",
+	"monitor.fs.health.enabled",
+	"monitor.fs.health.refresh_interval",
+	"monitor.fs.health.slow_path_logging_threshold",
+	"nameid.allow_create",
+	"nameid.sp_qualifier",
+	"network.bind_host",
+	"network.breaker.inflight_requests.limit",
+	"network.breaker.inflight_requests.overhead",
+	"network.host",
+	"network.publish_host",
+	"network.tcp.keep_alive",
+	"network.tcp.keep_count",
+	"network.tcp.keep_idle",
+	"network.tcp.keep_interval",
+	"network.tcp.no_delay",
+	"network.tcp.receive_buffer_size",
+	"network.tcp.reuse_address",
+	"network.tcp.send_buffer_size",
+	"network.thread.watchdog.interval",
+	"network.thread.watchdog.quiet_time",
+	"node.bandwidth.recovery.disk.read",
+	"node.bandwidth.recovery.disk.write",
+	"node.bandwidth.recovery.factor.read",
+	"node.bandwidth.recovery.factor.write",
+	"node.bandwidth.recovery.network",
+	"node.bandwidth.recovery.operator.factor",
+	"node.bandwidth.recovery.operator.factor.max_overcommit",
+	"node.bandwidth.recovery.operator.factor.read",
+	"node.bandwidth.recovery.operator.factor.write",
+	"node.roles: [ ml ]",
+	"node.roles: [ transform ]",
+	"op.authorization_endpoint",
+	"op.endsession_endpoint",
+	"op.issuer",
+	"op.jwkset_path",
+	"op.token_endpoint",
+	"op.userinfo_endpoint",
+	"org.elasticsearch.common.network.ThreadWatchdog",
+	"org.elasticsearch.transport.InboundHandler",
+	"org.elasticsearch.transport.OutboundHandler",
+	"pkc_jwkset_reload.enabled",
+	"pkc_jwkset_reload.file_interval",
+	"pkc_jwkset_reload.url_interval_max",
+	"pkc_jwkset_reload.url_interval_min",
+	"proxy.base_path",
+	"reindex.remote.blocklist",
+	"reindex.remote.whitelist",
+	"reindex.ssl.certificate",
+	"reindex.ssl.certificate_authorities",
+	"reindex.ssl.key",
+	"reindex.ssl.key_passphrase",
+	"reindex.ssl.keystore.key_password",
+	"reindex.ssl.keystore.password",
+	"reindex.ssl.keystore.path",
+	"reindex.ssl.keystore.secure_key_password",
+	"reindex.ssl.keystore.secure_password",
+	"reindex.ssl.keystore.type",
+	"reindex.ssl.secure_key_passphrase",
+	"reindex.ssl.truststore.password",
+	"reindex.ssl.truststore.path",
+	"reindex.ssl.truststore.secure_password",
+	"reindex.ssl.truststore.type",
+	"reindex.ssl.verification_mode",
+	"remote_cluster.bind_host",
+	"remote_cluster.host",
+	"remote_cluster.port",
+	"remote_cluster.publish_host",
+	"remote_cluster.publish_port",
+	"remote_cluster_server.enabled",
+	"remote_cluster.tcp.keep_alive",
+	"remote_cluster.tcp.keep_count",
+	"remote_cluster.tcp.keep_idle",
+	"remote_cluster.tcp.keep_interval",
+	"remote_cluster.tcp.no_delay",
+	"remote_cluster.tcp.receive_buffer_size",
+	"remote_cluster.tcp.reuse_address",
+	"remote_cluster.tcp.send_buffer_size",
+	"repositories.default_repository",
+	"rp.client_auth_jwt_signature_algorithm",
+	"rp.client_auth_method",
+	"rp.client_id",
+	"rp.client_secret",
+	"rp.post_logout_redirect_uri",
+	"rp.redirect_uri",
+	"rp.requested_scopes",
+	"rp.response_type",
+	"rp.signature_algorithm",
+	"script.max_compilations_rate",
+	"script.painless.regex.enabled",
+	"search.aggs.allowed_inline_metric_scripts",
+	"search.aggs.allowed_stored_metric_scripts",
+	"search.aggs.only_allowed_metric_scripts",
+	"search.max_buckets",
+	"search.task_watchdog.cooldown_period",
+	"search.task_watchdog.coordinator_threshold",
+	"search.task_watchdog.data_node_threshold",
+	"search.task_watchdog.enabled",
+	"search.task_watchdog.interval",
+	"signing.certificate",
+	"signing.key",
+	"signing.keystore.alias",
+	"signing.keystore.path",
+	"signing.keystore.secure_key_password",
+	"signing.keystore.secure_password",
+	"signing.keystore.type",
+	"signing.saml_messages",
+	"signing.secure_key_passphrase",
+	"slm.health.failed_snapshot_warn_threshold",
+	"slm.history_index_enabled",
+	"slm.retention_duration",
+	"slm.retention_schedule",
+	"smtp.auth",
+	"smtp.connection_timeout",
+	"smtp.host",
+	"smtp.local_address",
+	"smtp.local_port",
+	"smtp.port",
+	"smtp.secure_password",
+	"smtp.send_partial",
+	"smtp.ssl.trust",
+	"smtp.starttls.enable",
+	"smtp.starttls.required",
+	"smtp.timeout",
+	"smtp.user",
+	"smtp.wait_on_quit",
+	"smtp.write_timeout",
+	"snapshot.max_concurrent_operations",
+	"sp.acs",
+	"sp.entity_id",
+	"sp.logout",
+	"ssl.certificate",
+	"ssl.certificate_authorities",
+	"ssl.cipher_suites",
+	"ssl.key",
+	"ssl.key_passphrase",
+	"ssl.keystore.key_password",
+	"ssl.keystore.password",
+	"ssl.keystore.path",
+	"ssl.keystore.secure_key_password",
+	"ssl.keystore.secure_password",
+	"ssl.keystore.type",
+	"ssl.secure_key_passphrase",
+	"ssl.secure_keystore.password",
+	"ssl.supported_protocols",
+	"ssl.truststore.password",
+	"ssl.truststore.path",
+	"ssl.truststore.secure_password",
+	"ssl.truststore.type",
+	"ssl.verification_mode",
+	"stack.templates.enabled",
+	"timeout.ldap_search",
+	"timeout.response",
+	"timeout.tcp_connect",
+	"timeout.tcp_read",
+	"transport.bind_host",
+	"transport.compress",
+	"transport.compression_scheme",
+	"transport.connect_timeout",
+	"transport.host",
+	"transport.ping_schedule",
+	"transport.port",
+	"transport.profiles.$PROFILE.xpack.security.filter.allow",
+	"transport.profiles.$PROFILE.xpack.security.filter.deny",
+	"transport.publish_host",
+	"transport.publish_port",
+	"transport.tcp.keep_alive",
+	"transport.tcp.keep_count",
+	"transport.tcp.keep_idle",
+	"transport.tcp.keep_interval",
+	"transport.tcp.no_delay",
+	"transport.tcp.receive_buffer_size",
+	"transport.tcp.reuse_address",
+	"transport.tcp.send_buffer_size",
+	"truststore.algorithm",
+	"truststore.password",
+	"truststore.path",
+	"truststore.secure_password",
+	"user_search.attribute",
+	"user_search.base_dn",
+	"user_search.down_level_filter",
+	"user_search.filter",
+	"user_search.pool.enabled",
+	"user_search.pool.health_check.dn",
+	"user_search.pool.health_check.enabled",
+	"user_search.pool.health_check.interval",
+	"user_search.pool.initial_size",
+	"user_search.pool.size",
+	"user_search.scope",
+	"user_search.upn_filter",
+	"vectors.indexing.use_gpu",
+	"wait_master.timeout",
+	"xpack.http.connection_pool_ttl",
+	"xpack.http.default_connection_timeout",
+	"xpack.http.default_read_timeout",
+	"xpack.http.max_response_size",
+	"xpack.http.proxy.host",
+	"xpack.http.proxy.port",
+	"xpack.http.proxy.scheme",
+	"xpack.http.ssl.certificate",
+	"xpack.http.ssl.certificate_authorities",
+	"xpack.http.ssl.cipher_suites",
+	"xpack.http.ssl.key",
+	"xpack.http.ssl.keystore.path",
+	"xpack.http.ssl.keystore.secure_key_password",
+	"xpack.http.ssl.keystore.secure_password",
+	"xpack.http.ssl.keystore.type",
+	"xpack.http.ssl.secure_key_passphrase",
+	"xpack.http.ssl.supported_protocols",
+	"xpack.http.ssl.truststore.path",
+	"xpack.http.ssl.truststore.secure_password",
+	"xpack.http.ssl.truststore.type",
+	"xpack.http.ssl.verification_mode",
+	"xpack.http.tcp.keep_alive",
+	"xpack.http.whitelist",
+	"xpack.ilm.enabled",
+	"xpack.inference.ccm.cache.expiry_time",
+	"xpack.inference.ccm.cache.weight",
+	"xpack.inference.endpoint.cache.enabled",
+	"xpack.inference.endpoint.cache.expiry_time",
+	"xpack.inference.endpoint.cache.weight",
+	"xpack.inference.http.connection_eviction_interval",
+	"xpack.inference.http.connection_eviction_max_idle_time",
+	"xpack.inference.http.max_response_size",
+	"xpack.inference.http.max_route_connections",
+	"xpack.inference.http.max_total_connections",
+	"xpack.inference.http.request_executor.queue_capacity",
+	"xpack.inference.http.retry.initial_delay",
+	"xpack.inference.http.retry.max_delay_bound",
+	"xpack.inference.http.retry.timeout",
+	"xpack.inference.logging.reset_interval",
+	"xpack.inference.logging.wait_duration",
+	"xpack.inference.oauth2.token_cache.enabled",
+	"xpack.inference.oauth2.token_cache.expiry_time",
+	"xpack.inference.oauth2.token_cache.weight",
+	"xpack.inference.query_timeout",
+	"xpack.inference.truncator.reduction_percentage",
+	"xpack.license.self_generated.type",
+	"xpack.ml.anomalies.heal_reindexed_v7.enabled",
+	"xpack.ml.enable_config_migration",
+	"xpack.ml.enabled",
+	"xpack.ml.idle_job_auto_close_timeout",
+	"xpack.ml.inference_model.cache_size",
+	"xpack.ml.inference_model.time_to_live",
+	"xpack.ml.max_anomaly_records",
+	"xpack.ml.max_inference_processors",
+	"xpack.ml.max_lazy_ml_nodes",
+	"xpack.ml.max_machine_memory_percent",
+	"xpack.ml.max_ml_node_size",
+	"xpack.ml.max_model_memory_limit",
+	"xpack.ml.max_open_jobs",
+	"xpack.ml.model_repository",
+	"xpack.ml.nightly_maintenance_requests_per_second",
+	"xpack.ml.node_concurrent_job_allocations",
+	"xpack.ml.persist_results_max_retries",
+	"xpack.ml.process_connect_timeout",
+	"xpack.ml.results_index_rollover_max_size",
+	"xpack.ml.trained_models.graph_validation_enabled",
+	"xpack.ml.use_auto_machine_memory_percent",
+	"xpack.monitoring.collection.cluster.stats.timeout",
+	"xpack.monitoring.collection.enabled",
+	"xpack.monitoring.collection.index.recovery.active_only",
+	"xpack.monitoring.collection.index.recovery.timeout",
+	"xpack.monitoring.collection.index.stats.timeout",
+	"xpack.monitoring.collection.indices",
+	"xpack.monitoring.collection.interval",
+	"xpack.monitoring.collection.node.stats.timeout",
+	"xpack.monitoring.elasticsearch.collection.enabled",
+	"xpack.monitoring.enabled",
+	"xpack.monitoring.exporters",
+	"xpack.monitoring.exporters.$NAME.ssl.certificate",
+	"xpack.monitoring.exporters.$NAME.ssl.certificate_authorities",
+	"xpack.monitoring.exporters.$NAME.ssl.cipher_suites",
+	"xpack.monitoring.exporters.$NAME.ssl.key",
+	"xpack.monitoring.exporters.$NAME.ssl.key_passphrase",
+	"xpack.monitoring.exporters.$NAME.ssl.keystore.key_password",
+	"xpack.monitoring.exporters.$NAME.ssl.keystore.password",
+	"xpack.monitoring.exporters.$NAME.ssl.keystore.path",
+	"xpack.monitoring.exporters.$NAME.ssl.keystore.secure_key_password",
+	"xpack.monitoring.exporters.$NAME.ssl.keystore.secure_password",
+	"xpack.monitoring.exporters.$NAME.ssl.keystore.type",
+	"xpack.monitoring.exporters.$NAME.ssl.secure_key_passphrase",
+	"xpack.monitoring.exporters.$NAME.ssl.supported_protocols",
+	"xpack.monitoring.exporters.$NAME.ssl.truststore.password",
+	"xpack.monitoring.exporters.$NAME.ssl.truststore.path",
+	"xpack.monitoring.exporters.$NAME.ssl.truststore.secure_password",
+	"xpack.monitoring.exporters.$NAME.ssl.truststore.type",
+	"xpack.monitoring.exporters.$NAME.ssl.verification_mode",
+	"xpack.monitoring.history.duration",
+	"xpack.notification.email.account",
+	"xpack.notification.email.account.domain_allowlist",
+	"xpack.notification.email.default_account",
+	"xpack.notification.email.html.sanitization.allow",
+	"xpack.notification.email.html.sanitization.disallow",
+	"xpack.notification.email.html.sanitization.enabled",
+	"xpack.notification.email.recipient_allowlist",
+	"xpack.notification.email.ssl.certificate",
+	"xpack.notification.email.ssl.certificate_authorities",
+	"xpack.notification.email.ssl.cipher_suites",
+	"xpack.notification.email.ssl.key",
+	"xpack.notification.email.ssl.keystore.path",
+	"xpack.notification.email.ssl.keystore.secure_key_password",
+	"xpack.notification.email.ssl.keystore.secure_password",
+	"xpack.notification.email.ssl.keystore.type",
+	"xpack.notification.email.ssl.secure_key_passphrase",
+	"xpack.notification.email.ssl.supported_protocols",
+	"xpack.notification.email.ssl.truststore.path",
+	"xpack.notification.email.ssl.truststore.secure_password",
+	"xpack.notification.email.ssl.truststore.type",
+	"xpack.notification.email.ssl.verification_mode",
+	"xpack.notification.jira.account",
+	"xpack.notification.jira.default_account",
+	"xpack.notification.pagerduty",
+	"xpack.notification.pagerduty.account",
+	"xpack.notification.pagerduty.default_account",
+	"xpack.notification.slack",
+	"xpack.notification.slack.account",
+	"xpack.notification.slack.default_account",
+	"xpack.notification.webhook.additional_token_enabled",
+	"xpack.otel_data.histogram_field_type",
+	"xpack.otel_data.registry.enabled",
+	"xpack.profiling.enabled",
+	"xpack.profiling.templates.enabled",
+	"xpack.security.audit.enabled",
+	"xpack.security.audit.logfile.emit_node_host_address",
+	"xpack.security.audit.logfile.emit_node_host_name",
+	"xpack.security.audit.logfile.emit_node_id",
+	"xpack.security.audit.logfile.emit_node_name",
+	"xpack.security.audit.logfile.events.emit_request_body",
+	"xpack.security.audit.logfile.events.exclude",
+	"xpack.security.audit.logfile.events.include",
+	"xpack.security.authc.anonymous.authz_exception",
+	"xpack.security.authc.anonymous.roles",
+	"xpack.security.authc.anonymous.username",
+	"xpack.security.authc.api_key.cache.hash_algo",
+	"xpack.security.authc.api_key.cache.max_keys",
+	"xpack.security.authc.api_key.cache.ttl",
+	"xpack.security.authc.api_key.delete.interval",
+	"xpack.security.authc.api_key.delete.retention_period",
+	"xpack.security.authc.api_key.delete.timeout",
+	"xpack.security.authc.api_key.enabled",
+	"xpack.security.authc.api_key.hashing.algorithm",
+	"xpack.security.authc.password_hashing.algorithm",
+	"xpack.security.authc.realms.jwt.*",
+	"xpack.security.authc.realms.kerberos.*",
+	"xpack.security.authc.realms.oidc.*",
+	"xpack.security.authc.realms.saml.*",
+	"xpack.security.authc.token.enabled",
+	"xpack.security.authc.token.timeout",
+	"xpack.security.autoconfiguration.enabled",
+	"xpack.security.automata.cache.enabled",
+	"xpack.security.automata.cache.size",
+	"xpack.security.automata.cache.ttl",
+	"xpack.security.automata.max_determinized_states",
+	"xpack.security.dls.bitset.cache.size",
+	"xpack.security.dls.bitset.cache.ttl",
+	"xpack.security.dls_fls.enabled",
+	"xpack.security.enabled",
+	"xpack.security.enrollment.enabled",
+	"xpack.security.fips_mode.enabled",
+	"xpack.security.fips_mode.required_providers",
+	"xpack.security.hide_settings",
+	"xpack.security.http.filter.allow",
+	"xpack.security.http.filter.deny",
+	"xpack.security.http.ssl.certificate",
+	"xpack.security.http.ssl.certificate_authorities",
+	"xpack.security.http.ssl.cipher_suites",
+	"xpack.security.http.ssl.client_authentication",
+	"xpack.security.http.ssl.enabled",
+	"xpack.security.http.ssl.key",
+	"xpack.security.http.ssl.key_passphrase",
+	"xpack.security.http.ssl.keystore.key_password",
+	"xpack.security.http.ssl.keystore.password",
+	"xpack.security.http.ssl.keystore.path",
+	"xpack.security.http.ssl.keystore.secure_key_password",
+	"xpack.security.http.ssl.keystore.secure_password",
+	"xpack.security.http.ssl.keystore.type",
+	"xpack.security.http.ssl.secure_key_passphrase",
+	"xpack.security.http.ssl.supported_protocols",
+	"xpack.security.http.ssl.truststore.password",
+	"xpack.security.http.ssl.truststore.path",
+	"xpack.security.http.ssl.truststore.secure_password",
+	"xpack.security.http.ssl.truststore.type",
+	"xpack.security.http.ssl.verification_mode",
+	"xpack.security.loginAssistanceMessage",
+	"xpack.security.remote_cluster_client.ssl.certificate",
+	"xpack.security.remote_cluster_client.ssl.certificate_authorities",
+	"xpack.security.remote_cluster_client.ssl.cipher_suites",
+	"xpack.security.remote_cluster_client.ssl.enabled",
+	"xpack.security.remote_cluster_client.ssl.handshake_timeout",
+	"xpack.security.remote_cluster_client.ssl.key",
+	"xpack.security.remote_cluster_client.ssl.keystore.path",
+	"xpack.security.remote_cluster_client.ssl.keystore.secure_key_password",
+	"xpack.security.remote_cluster_client.ssl.keystore.secure_password",
+	"xpack.security.remote_cluster_client.ssl.keystore.type",
+	"xpack.security.remote_cluster_client.ssl.secure_key_passphrase",
+	"xpack.security.remote_cluster_client.ssl.supported_protocols",
+	"xpack.security.remote_cluster_client.ssl.truststore.path",
+	"xpack.security.remote_cluster_client.ssl.truststore.secure_password",
+	"xpack.security.remote_cluster_client.ssl.truststore.type",
+	"xpack.security.remote_cluster_client.ssl.verification_mode",
+	"xpack.security.remote_cluster.filter.allow",
+	"xpack.security.remote_cluster.filter.deny",
+	"xpack.security.remote_cluster_server.ssl.certificate",
+	"xpack.security.remote_cluster_server.ssl.certificate_authorities",
+	"xpack.security.remote_cluster_server.ssl.cipher_suites",
+	"xpack.security.remote_cluster_server.ssl.client_authentication",
+	"xpack.security.remote_cluster_server.ssl.enabled",
+	"xpack.security.remote_cluster_server.ssl.handshake_timeout",
+	"xpack.security.remote_cluster_server.ssl.key",
+	"xpack.security.remote_cluster_server.ssl.keystore.path",
+	"xpack.security.remote_cluster_server.ssl.keystore.secure_key_password",
+	"xpack.security.remote_cluster_server.ssl.keystore.secure_password",
+	"xpack.security.remote_cluster_server.ssl.keystore.type",
+	"xpack.security.remote_cluster_server.ssl.secure_key_passphrase",
+	"xpack.security.remote_cluster_server.ssl.supported_protocols",
+	"xpack.security.remote_cluster_server.ssl.truststore.path",
+	"xpack.security.remote_cluster_server.ssl.truststore.secure_password",
+	"xpack.security.remote_cluster_server.ssl.truststore.type",
+	"xpack.security.remote_cluster_server.ssl.verification_mode",
+	"xpack.security.ssl.diagnose.trust",
+	"xpack.security.transport.filter.allow",
+	"xpack.security.transport.filter.deny",
+	"xpack.security.transport.ssl.certificate",
+	"xpack.security.transport.ssl.certificate_authorities",
+	"xpack.security.transport.ssl.cipher_suites",
+	"xpack.security.transport.ssl.client_authentication",
+	"xpack.security.transport.ssl.enabled",
+	"xpack.security.transport.ssl.handshake_timeout",
+	"xpack.security.transport.ssl.key",
+	"xpack.security.transport.ssl.key_passphrase",
+	"xpack.security.transport.ssl.keystore.key_password",
+	"xpack.security.transport.ssl.keystore.password",
+	"xpack.security.transport.ssl.keystore.path",
+	"xpack.security.transport.ssl.keystore.secure_key_password",
+	"xpack.security.transport.ssl.keystore.secure_password",
+	"xpack.security.transport.ssl.keystore.type",
+	"xpack.security.transport.ssl.secure_key_passphrase",
+	"xpack.security.transport.ssl.supported_protocols",
+	"xpack.security.transport.ssl.trust_restrictions.x509_fields",
+	"xpack.security.transport.ssl.truststore.password",
+	"xpack.security.transport.ssl.truststore.path",
+	"xpack.security.transport.ssl.truststore.secure_password",
+	"xpack.security.transport.ssl.truststore.type",
+	"xpack.security.transport.ssl.verification_mode",
+	"xpack.transform.enabled",
+	"xpack.transform.num_transform_failure_retries",
+	"xpack.watcher.enabled",
+	"xpack.watcher.encryption_key",
+	"xpack.watcher.encrypt_sensitive_data",
+	"xpack.watcher.history.cleaner_service.enabled",
+	"xpack.watcher.max.history.record.size",
+	"xpack.watcher.trigger.schedule.engine",
+}
--- a/pkg/es/cluster_util.go
+++ b/pkg/es/cluster_util.go
@@ -18,16 +18,12 @@ package es

 import (
 	"context"
-	"errors"
 	"fmt"
 	"regexp"
-	"strconv"
 	"strings"
-	"sync"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
-	"github.com/elastic/go-elasticsearch/v9"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )
@@ -37,12 +33,11 @@ const (
 )

 func checkClusterIsLeader(conf *cfg.Config, leader string) bool {
-	stats, err := conf.Clusters[leader].ES.Ccr.Stats().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	stats, err := conf.Clusters[leader].ES().Ccr.Stats().
 		Do(context.Background())
 	if err != nil {
 		fmt.Printf("failed to get ccr stats from %s: %s", leader, esErrorString(err))
+
 		return false
 	}

@@ -53,6 +48,7 @@ func checkClusterIsLeader(conf *cfg.Config, leader string) bool {

 	if stats.AutoFollowStats.AutoFollowedClusters[0].ClusterName != "" {
 		fmt.Println("leader/follower attribution is invalid, reverse cluster attribution and retry")
+
 		return false
 	}

@@ -64,48 +60,48 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {
 	status := map[string]*health.Response{}

 	for _, cluster := range []string{leader, follower} {
-		st, err := conf.Clusters[leader].ES.Cluster.Health().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
+		clusterHealth, err := conf.Clusters[leader].ES().Cluster.Health().
 			Do(context.Background())
 		if err != nil {
 			fmt.Printf("failed to get health from %s: %s", cluster, esErrorString(err))
+
 			return false
 		}

-		status[cluster] = st
+		status[cluster] = clusterHealth
 	}

 	table := printer.NewTable(conf, 3, 6)

 	table.Addheaders("setting", "leader:"+leader, "follower:"+follower)

-	table.Entries = [][]string{
+	table.Entries = [][]any{
 		{"Cluster Name", status[leader].ClusterName, status[follower].ClusterName},
 		{"Cluster Status",
 			printer.Colorize(conf, status[leader].Status.Name, status[leader].Status.Name),
 			printer.Colorize(conf, status[follower].Status.Name, status[follower].Status.Name),
 		},
 		{"Active Shards",
-			fmt.Sprintf("%d", status[leader].ActiveShards),
-			fmt.Sprintf("%d", status[follower].ActiveShards),
+			status[leader].ActiveShards,
+			status[follower].ActiveShards,
 		},
 		{"Active Primary Shards",
-			fmt.Sprintf("%d", status[leader].ActivePrimaryShards),
-			fmt.Sprintf("%d", status[follower].ActivePrimaryShards),
+			status[leader].ActivePrimaryShards,
+			status[follower].ActivePrimaryShards,
 		},
 		{"Indicies",
-			fmt.Sprintf("%d", len(status[leader].Indices)),
-			fmt.Sprintf("%d", len(status[follower].Indices)),
+			len(status[leader].Indices),
+			len(status[follower].Indices),
 		},
 		{"Nodes",
-			fmt.Sprintf("%d", status[leader].NumberOfNodes),
-			fmt.Sprintf("%d", status[follower].NumberOfNodes),
+			status[leader].NumberOfNodes,
+			status[follower].NumberOfNodes,
 		},
 	}

 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}

@@ -120,26 +116,25 @@ func checkClusterStatus(conf *cfg.Config, leader, follower string) bool {

 // finds indices on both clusters which have ilm errors
 func findIlmErrors(conf *cfg.Config, leader, follower string) bool {
-	failed := map[string]map[string]string{}
+	failed := map[string]map[string]any{}

 	for _, cluster := range []string{leader, follower} {
-		ilm, err := conf.Clusters[cluster].ES.Ilm.ExplainLifecycle("_all").
+		ilm, err := conf.Clusters[cluster].ES().Ilm.ExplainLifecycle("_all").
 			OnlyManaged(true).
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
 			Do(context.Background())
 		if err != nil {
 			fmt.Printf("failed to get ilm status from %s: %s", cluster, esErrorString(err))
+
 			return false
 		}

-		failed[cluster] = map[string]string{}
+		failed[cluster] = map[string]any{}

 		for name, ilmstate := range ilm.Indices {
 			count := ilmstate.(*types.LifecycleExplainManaged).FailedStepRetryCount

 			if count != nil && *count > 0 {
-				failed[cluster][name] = fmt.Sprintf("%d", *count)
+				failed[cluster][name] = *count
 			}
 		}
 	}
@@ -160,7 +155,7 @@ func findIlmErrors(conf *cfg.Config, leader, follower string) bool {
 			table.Addheaders("ilm errors on "+which, "errors")

 			for name, count := range failed[cluster] {
-				table.Entries[idx] = []string{name, count}
+				table.Entries[idx] = []any{name, count}
 				idx++
 			}

@@ -168,6 +163,7 @@ func findIlmErrors(conf *cfg.Config, leader, follower string) bool {

 			if err := table.Print(); err != nil {
 				fmt.Println(err)
+
 				return false
 			}
 		}
@@ -184,6 +180,7 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 	}

 	indexOnlyOnLeader := map[string]*types.IndicesRecord{}
+
 	for name, index := range indices[leader] {
 		if exclude.MatchString(name) {
 			continue
@@ -192,9 +189,7 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 		_, followerHasIt := indices[follower][name]
 		if !followerHasIt {
 			// fetch index details
-			res, err := conf.Clusters[leader].ES.Indices.Get(name).
-				Header("content-type", "application/json").
-				Header("accept", "application/json").
+			res, err := conf.Clusters[leader].ES().Indices.Get(name).
 				Do(context.Background())
 			if err != nil {
 				continue // ignore it then
@@ -207,9 +202,11 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 			}

 			isWritable := false
+
 			for _, alias := range res[name].Aliases {
 				if *alias.IsWriteIndex {
 					isWritable = true
+
 					break
 				}
 			}
@@ -234,13 +231,15 @@ func findIndicesOnlyOnLeader(conf *cfg.Config, indices ClusterIndices, leader, f
 	for name, index := range indexOnlyOnLeader {
 		name := printer.Colorize(conf, "red", name)

-		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []any{name, *index.DatasetSize, *index.DocsCount}
 		idx++
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}

@@ -255,9 +254,7 @@ func findOrphanedIndices(conf *cfg.Config, indices ClusterIndices, leader, follo
 		_, leaderHasIt := indices[leader][name]
 		if !leaderHasIt {
 			// fetch index details
-			res, err := conf.Clusters[follower].ES.Indices.Get(name).
-				Header("content-type", "application/json").
-				Header("accept", "application/json").
+			res, err := conf.Clusters[follower].ES().Indices.Get(name).
 				Do(context.Background())
 			if err != nil {
 				continue // ignore it then
@@ -284,13 +281,15 @@ func findOrphanedIndices(conf *cfg.Config, indices ClusterIndices, leader, follo
 	for name, index := range orphaned {
 		name := printer.Colorize(conf, "red", name)

-		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []any{name, *index.DatasetSize, *index.DocsCount}
 		idx++
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}

@@ -318,13 +317,15 @@ func findFailedFollowerIndices(conf *cfg.Config, indices ClusterIndices, followe
 	for name, index := range red {
 		name := printer.Colorize(conf, "red", name)

-		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []any{name, *index.DatasetSize, *index.DocsCount}
 		idx++
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		fmt.Println(err)
+
 		return false
 	}

@@ -343,119 +344,3 @@ func splitArg(arg string) (string, string) {
 		return parts[0], parts[1]
 	}
 }
-
-func getClusterData(es *elasticsearch.TypedClient, wg *sync.WaitGroup, reschan chan apiResponse, which string) {
-	defer wg.Done()
-
-	ar := apiResponse{}
-	arerr := errors.New("")
-
-	switch which {
-	case "health":
-		res, err := es.Cluster.Health().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
-			Do(context.Background())
-
-		ar.health = res
-		ar.which = ResponseHealth
-		arerr = err
-
-	case "info":
-		res, err := es.Info().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
-			Do(context.Background())
-
-		ar.info = res
-		ar.which = ResponseInfo
-		arerr = err
-
-	case "ccrstats":
-		res, err := es.Ccr.Stats().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
-			Do(context.Background())
-
-		ar.ccr = res
-		ar.which = ResponseCcr
-		arerr = err
-
-	case "stats":
-		res, err := es.Cluster.Stats().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
-			Do(context.Background())
-
-		ar.stats = res
-		ar.which = ResponseStats
-		arerr = err
-
-	case "indices":
-		res, err := es.Cat.Indices().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
-			Do(context.Background())
-
-		ar.indices = &res
-		ar.which = ResponseIndices
-		arerr = err
-
-	case "tasks":
-		res, err := es.Cat.Tasks().
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
-			Do(context.Background())
-
-		ar.tasks = &res
-		ar.which = ResponseTasks
-		arerr = err
-	}
-
-	if arerr != nil {
-		ar.error = fmt.Errorf("failed to get cluster health: %s", arerr)
-	}
-
-	reschan <- ar
-}
-
-// recursively traverse  the raw  settings hash and  build a  flat map
-// consisting of the translated path and its value.
-//
-// e.g.
-// logger:
-//
-//	org:
-//	  elasticsearch:
-//	    transport:
-//	      OutboundHandler: "ERROR"
-//
-// gets:
-//
-// logger.org.elasticsearch.transport.OutboundHandler: "ERROR"
-func getJsonPath(paths map[string]string, raw map[string]any, topic string) map[string]string {
-	for name, data := range raw {
-		path := topic + "." + name
-
-		switch value := data.(type) {
-		case string:
-			paths[path] = value
-		case *string:
-			paths[path] = *value
-		case int:
-			paths[path] = strconv.Itoa(value)
-		case *int:
-			paths[path] = strconv.Itoa(*value)
-		case map[string]any:
-			paths = getJsonPath(paths, value, path)
-		case []any:
-			val := []string{}
-			for _, item := range value {
-				val = append(val, fmt.Sprintf("%v", item))
-			}
-			paths[path] = strings.Join(val, ",")
-		}
-	}
-
-	return paths
-}
--- a/pkg/es/datastream.go
+++ b/pkg/es/datastream.go
@@ -25,17 +25,14 @@ import (

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
-	"github.com/dustin/go-humanize"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )

 func DatastreamNames(conf *cfg.Config) ([]string, error) {
-	res, err := conf.DefaultCluster.ES.Indices.GetDataStream().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Indices.GetDataStream().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get data streams: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get data streams: %w", esErrorString(err))
 	}

 	dss := make([]string, len(res.DataStreams))
@@ -47,12 +44,10 @@ func DatastreamNames(conf *cfg.Config) ([]string, error) {
 }

 func DatastreamList(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Indices.GetDataStream().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Indices.GetDataStream().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get data streams: %s", esErrorString(err))
+		return fmt.Errorf("failed to get data streams: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "data streams", res)
@@ -70,21 +65,22 @@ func DatastreamList(conf *cfg.Config) error {
 	table := printer.NewTable(conf, 7, size)
 	table.Addheaders("name", "ilm policy", "hidden", "system", "replicated", "generation", "timestamp field")

-	for idx, ds := range list {
-		name := printer.Colorize(conf, ds.Status.String(), ds.Name)
+	for idx, datastream := range list {
+		name := printer.Colorize(conf, datastream.Status.String(), datastream.Name)
+
 		policy := ""
-		if ds.IlmPolicy != nil {
-			policy = *ds.IlmPolicy
+		if datastream.IlmPolicy != nil {
+			policy = *datastream.IlmPolicy
 		}

-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			name,
 			policy,
-			fmt.Sprintf("%t", ds.Hidden),
-			fmt.Sprintf("%t", *ds.System),
-			fmt.Sprintf("%t", *ds.Replicated),
-			fmt.Sprintf("%d", ds.Generation),
-			ds.TimestampField.Name,
+			datastream.Hidden,
+			*datastream.System,
+			*datastream.Replicated,
+			datastream.Generation,
+			datastream.TimestampField.Name,
 		}

 		if idx == size-1 {
@@ -93,6 +89,7 @@ func DatastreamList(conf *cfg.Config) error {
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -129,13 +126,11 @@ func filterDatastreams(conf *cfg.Config, list []types.DataStream) []types.DataSt
 }

 func DatastreamShow(conf *cfg.Config, dsname string) error {
-	res, err := conf.DefaultCluster.ES.Indices.GetDataStream().
+	res, err := conf.DefaultCluster.ES().Indices.GetDataStream().
 		Name(dsname).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get data stream: %s", esErrorString(err))
+		return fmt.Errorf("failed to get data stream: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "data stream", res)
@@ -144,67 +139,67 @@ func DatastreamShow(conf *cfg.Config, dsname string) error {
 		return errors.New("no data stream found with that name")
 	}

-	stats, err := conf.DefaultCluster.ES.Indices.DataStreamsStats().
+	stats, err := conf.DefaultCluster.ES().Indices.DataStreamsStats().
 		Name(dsname).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get data stream stats: %s", esErrorString(err))
+		return fmt.Errorf("failed to get data stream stats: %w", esErrorString(err))
 	}

 	table := printer.NewTable(conf, 11, 2)
 	table.Addheaders("data stream property", "value")

-	ds := res.DataStreams[0]
+	datastream := res.DataStreams[0]
+
+	name := printer.Colorize(conf, datastream.Status.String(), datastream.Name)

-	name := printer.Colorize(conf, ds.Status.String(), ds.Name)
 	policy := ""
-	if ds.IlmPolicy != nil {
-		policy = *ds.IlmPolicy
+	if datastream.IlmPolicy != nil {
+		policy = *datastream.IlmPolicy
 	}

-	table.Entries = [][]string{
+	table.Entries = [][]any{
 		{"name", name},
 		{"ilm policy", policy},
-		{"hidden", fmt.Sprintf("%t", ds.Hidden)},
-		{"system", fmt.Sprintf("%t", *ds.System)},
-		{"replicated", fmt.Sprintf("%t", *ds.Replicated)},
-		{"generation", fmt.Sprintf("%d", ds.Generation)},
-		{"timestamp field", ds.TimestampField.Name},
-		{"backing indices", fmt.Sprintf("%d", stats.BackingIndices)},
-		{"size", humanize.Bytes(uint64(stats.TotalStoreSizeBytes))},
-		{"shards-failed", fmt.Sprintf("%d", stats.Shards_.Failed)},
-		{"shards-successful", fmt.Sprintf("%d", stats.Shards_.Successful)},
+		{"hidden", datastream.Hidden},
+		{"system", *datastream.System},
+		{"replicated", *datastream.Replicated},
+		{"generation", datastream.Generation},
+		{"timestamp field", datastream.TimestampField.Name},
+		{"backing indices", stats.BackingIndices},
+		{"size", printer.Bytes(stats.TotalStoreSizeBytes)},
+		{"shards-failed", stats.Shards_.Failed},
+		{"shards-successful", stats.Shards_.Successful},
 	}

 	if err := table.Print(); err != nil {
 		return err
 	}

-	table = printer.NewTable(conf, 5, len(ds.Indices))
+	table = printer.NewTable(conf, 5, len(datastream.Indices))
 	table.Addheaders("backing index name", "uuid", "prefer ilm", "ilm policy", "managed by")

-	for idx, index := range ds.Indices {
+	for idx, index := range datastream.Indices {
 		policy := ""
-		if ds.IlmPolicy != nil {
-			policy = *ds.IlmPolicy
+		if datastream.IlmPolicy != nil {
+			policy = *datastream.IlmPolicy
 		}

-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			index.IndexName,
 			index.IndexUuid,
-			fmt.Sprintf("%t", *index.PreferIlm),
+			*index.PreferIlm,
 			policy,
 			index.ManagedBy.Name,
 		}

-		if idx < len(ds.Indices) {
+		if idx < len(datastream.Indices) {
 			fmt.Println()
 		}
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -213,26 +208,20 @@ func DatastreamShow(conf *cfg.Config, dsname string) error {
 }

 func DatastreamCreate(conf *cfg.Config, dsname string) error {
-	_, err := conf.DefaultCluster.ES.Indices.CreateDataStream(dsname).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	_, err := conf.DefaultCluster.ES().Indices.CreateDataStream(dsname).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create datastream: %s", esErrorString(err))
+		return fmt.Errorf("failed to create datastream: %w", esErrorString(err))
 	}

 	return nil
 }

 func DatastreamDelete(conf *cfg.Config, dsname string) error {
-	_, err := conf.DefaultCluster.ES.Indices.DeleteDataStream(dsname).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	_, err := conf.DefaultCluster.ES().Indices.DeleteDataStream(dsname).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to delete datastream: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete datastream: %w", esErrorString(err))
 	}

 	return nil
@@ -240,17 +229,16 @@ func DatastreamDelete(conf *cfg.Config, dsname string) error {

 func DatastreamRollover(conf *cfg.Config, ds string) error {
 	res, err := RolloverAlias(conf, ds)
-
 	if err != nil {
-		return fmt.Errorf("failed to rollover data stream: %s", esErrorString(err))
+		return fmt.Errorf("failed to rollover data stream: %w", esErrorString(err))
 	}

 	table := printer.NewTable(conf, 2, 5)
 	table.Addheaders("rollover response", "value")
-	table.Entries = [][]string{
-		{"acknowledged", fmt.Sprintf("%t", res.Acknowledged)},
-		{"rolled over", fmt.Sprintf("%t", res.RolledOver)},
-		{"shards acknowledged", fmt.Sprintf("%t", res.ShardsAcknowledged)},
+	table.Entries = [][]any{
+		{"acknowledged", res.Acknowledged},
+		{"rolled over", res.RolledOver},
+		{"shards acknowledged", res.ShardsAcknowledged},
 		{"old index", res.OldIndex},
 		{"new index", res.NewIndex},
 	}
--- a/pkg/es/debug.go
+++ b/pkg/es/debug.go
@@ -0,0 +1,48 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/alecthomas/repr"
+)
+
+func Debug(conf *cfg.Config) error {
+	report, err := getHealthReport(conf)
+	if err != nil {
+		return err
+	}
+
+	repr.Println(report)
+	/*
+		res, err := conf.DefaultCluster.ES().Search().
+			Index(conf.Index).
+			Size(0).
+			Aggregations(map[string]types.Aggregations{
+				"min_ts": *esdsl.NewMinAggregation().Field("@timestamp").AggregationsCaster(),
+				"max_ts": *esdsl.NewMaxAggregation().Field("@timestamp").AggregationsCaster(),
+			}).
+			Do(context.Background())
+
+		if err != nil {
+			return err
+		}
+
+		repr.Println(res)
+	*/
+	return nil
+}
--- a/pkg/es/doc.go
+++ b/pkg/es/doc.go
@@ -22,6 +22,7 @@ import (
 	"errors"
 	"fmt"
 	"math/rand/v2"
+	"strconv"
 	"strings"

 	"codeberg.org/scip/esctl/pkg/cfg"
@@ -42,18 +43,16 @@ func DocAdd(conf *cfg.Config, jsondoc string) error {

 	err := json.Unmarshal([]byte(jsondoc), &data)
 	if err != nil {
-		return fmt.Errorf("supplied document was not valid JSON: %s", err)
+		return fmt.Errorf("supplied document was not valid JSON: %w", err)
 	}

-	now := fmt.Sprintf("%d", rand.Int64())
+	now := strconv.FormatInt(rand.Int64(), 10)

-	res, err := conf.DefaultCluster.ES.Create(conf.Index, now).
+	res, err := conf.DefaultCluster.ES().Create(conf.Index, now).
 		Document(data).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to create new doc in index %s: %s", conf.Index, esErrorString(err))
+		return fmt.Errorf("failed to create new doc in index %s: %w", conf.Index, esErrorString(err))
 	}

 	fmt.Println(res.Id_)
@@ -62,12 +61,10 @@ func DocAdd(conf *cfg.Config, jsondoc string) error {
 }

 func DocShow(conf *cfg.Config, id string) error {
-	res, err := conf.DefaultCluster.ES.Get(conf.Index, id).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Get(conf.Index, id).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve doc in index %s: %s", conf.Index, esErrorString(err))
+		return fmt.Errorf("failed to retrieve doc in index %s: %w", conf.Index, esErrorString(err))
 	}

 	if !res.Found {
@@ -95,12 +92,10 @@ func DocDelete(conf *cfg.Config, queries []string) error {
 	if len(queries) == 1 && strings.Contains(queries[0], "id=") {
 		id, _ := strings.CutPrefix(queries[0], "id=")

-		_, err := conf.DefaultCluster.ES.Delete(conf.Index, id).
-			Header("content-type", "application/json").
-			Header("accept", "application/json").
+		_, err := conf.DefaultCluster.ES().Delete(conf.Index, id).
 			Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to delete doc in index %s: %s", conf.Index, esErrorString(err))
+			return fmt.Errorf("failed to delete doc in index %s: %w", conf.Index, esErrorString(err))
 		}

 		return nil
@@ -119,13 +114,11 @@ func DocDelete(conf *cfg.Config, queries []string) error {
 		req.Query = queryCaster
 	}

-	_, err := conf.DefaultCluster.ES.DeleteByQuery(conf.Index).
+	_, err := conf.DefaultCluster.ES().DeleteByQuery(conf.Index).
 		Request(req).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to delete docs in index %s: %s", conf.Index, esErrorString(err))
+		return fmt.Errorf("failed to delete docs in index %s: %w", conf.Index, esErrorString(err))
 	}

 	return nil
--- a/pkg/es/duration.go
+++ b/pkg/es/duration.go
@@ -0,0 +1,127 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"fmt"
+	"math"
+	"regexp"
+	"strconv"
+	"time"
+)
+
+var (
+	matchDuration = regexp.MustCompile(`(\d+)([dhms])`)
+)
+
+type esDuration struct {
+	days, hours, minutes, seconds int
+}
+
+/*
+We could use time.ParseDuration(), but this doesn't support days.
+
+We  could also  use github.com/xhit/go-str2duration/v2,  which does
+the job,  but it's  just another dependency,  just for  this little
+gem. And  we don't need a  time.Time value. And int  is good enough
+for duration comparison.
+
+Convert a  duration into  an integer.  Valid  time units  are "s", "m", "h" and "d".
+
+	via https://codeberg.org/scip/tablizer/src/branch/main/lib/sort.go#L113
+*/
+func parseDuration(duration string) time.Duration {
+	seconds := 0
+
+	for _, match := range matchDuration.FindAllStringSubmatch(duration, -1) {
+		if len(match) == 3 {
+			durationvalue, _ := strconv.Atoi(match[1])
+
+			switch match[2][0] {
+			case 'd':
+				seconds += durationvalue * 86400
+			case 'h':
+				seconds += durationvalue * 3600
+			case 'm':
+				seconds += durationvalue * 60
+			case 's':
+				seconds += durationvalue
+			}
+		}
+	}
+
+	return time.Duration(seconds) * time.Second
+}
+
+// pretty much the same as above, but return a struct filled with int duration values
+func extractDuration(duration string) esDuration {
+	esd := esDuration{}
+
+	for _, match := range matchDuration.FindAllStringSubmatch(duration, -1) {
+		if len(match) == 3 {
+			durationvalue, _ := strconv.Atoi(match[1])
+
+			switch match[2][0] {
+			case 'd':
+				esd.days = durationvalue
+			case 'h':
+				esd.hours = durationvalue
+			case 'm':
+				esd.minutes = durationvalue
+			case 's':
+				esd.seconds = durationvalue
+			}
+		}
+	}
+
+	return esd
+}
+
+// convert a duration like 156h6m15.095s-6d/12h/6m => 6d:12h:6m
+func formatDuration(val time.Duration) string {
+	esd := extractDuration(val.String())
+
+	daysF := float64(esd.hours) / 24.0
+	days := math.Floor(daysF)
+	hoursLeft := (daysF - days) * 24
+
+	switch {
+	case val.Minutes() < 1:
+		return fmt.Sprintf("%ds", int64(esd.seconds))
+
+	case val.Hours() < 1:
+		return fmt.Sprintf("%dm", int64(esd.minutes))
+
+	case val.Hours() < 24:
+		if esd.minutes == 0 {
+			return fmt.Sprintf("%dh", esd.hours)
+		}
+
+		return fmt.Sprintf("%dh:%dm", esd.hours, int64(esd.minutes))
+
+	default:
+		if esd.minutes == 0 && hoursLeft == 0 {
+			return fmt.Sprintf("%dd", int64(days))
+		}
+
+		return fmt.Sprintf("%dd:%dh:%dm",
+			int64(days),
+			int64(hoursLeft),
+			esd.minutes,
+		)
+	}
+}
--- a/pkg/es/errors.go
+++ b/pkg/es/errors.go
@@ -17,29 +17,31 @@ along with this program. If not, see <http://www.gnu.org/licenses/>.
 package es

 import (
+	"errors"
 	"fmt"
+	"strings"

 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )

-func esErrorString(err error) string {
+func esErrorString(err error) error {
 	msg := err.Error()

-	switch e := err.(type) {
+	//nolint:gocritic
+	switch errVal := err.(type) {
 	case *types.ElasticsearchError:
-		causes := ""
+		var causes strings.Builder

-		for _, cause := range e.ErrorCause.RootCause {
-			causes += fmt.Sprintf("%s\n", *cause.Reason)
+		for _, cause := range errVal.ErrorCause.RootCause {
+			fmt.Fprintf(&causes, "%s\n", *cause.Reason)
 		}

-		if e.ErrorCause.Reason != nil {
-			msg = *e.ErrorCause.Reason + ": " + causes
+		if errVal.ErrorCause.Reason != nil {
+			msg = *errVal.ErrorCause.Reason + ": " + causes.String()
 		} else {
-			msg = fmt.Sprintf("http status %d: ", e.Status)
+			msg = fmt.Sprintf("http status %d: ", errVal.Status)
 		}
-
 	}

-	return msg
+	return errors.New(msg)
 }
--- a/pkg/es/ilm.go
+++ b/pkg/es/ilm.go
@@ -18,6 +18,7 @@ package es

 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -26,26 +27,27 @@ import (
 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
 	"github.com/alecthomas/repr"
+	"github.com/charmbracelet/lipgloss"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/putlifecycle"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
 )

 func IlmRetry(conf *cfg.Config, index string) error {
-	_, err := conf.DefaultCluster.ES.Ilm.Retry(index).
+	_, err := conf.DefaultCluster.ES().Ilm.Retry(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retry ilm: %s", esErrorString(err))
+		return fmt.Errorf("failed to retry ilm: %w", esErrorString(err))
 	}

 	return nil
 }

 func IlmStatus(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Ilm.GetStatus().
+	res, err := conf.DefaultCluster.ES().Ilm.GetStatus().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm status: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm status: %w", esErrorString(err))
 	}

 	fmt.Println(res.OperationMode.Name)
@@ -54,10 +56,10 @@ func IlmStatus(conf *cfg.Config) error {
 }

 func IlmNames(conf *cfg.Config) ([]string, error) {
-	res, err := conf.DefaultCluster.ES.Ilm.GetLifecycle().
+	res, err := conf.DefaultCluster.ES().Ilm.GetLifecycle().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get ilm policies: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get ilm policies: %w", esErrorString(err))
 	}

 	names := make([]string, len(res))
@@ -65,13 +67,14 @@ func IlmNames(conf *cfg.Config) ([]string, error) {

 	for name := range res {
 		names[idx] = name
+		idx++
 	}

 	return names, nil
 }

 func IlmList(conf *cfg.Config, pattern string) error {
-	ilm := conf.DefaultCluster.ES.Ilm.GetLifecycle()
+	ilm := conf.DefaultCluster.ES().Ilm.GetLifecycle()

 	if pattern != "" {
 		ilm.FilterPath(pattern)
@@ -79,7 +82,7 @@ func IlmList(conf *cfg.Config, pattern string) error {

 	res, err := ilm.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm policies: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm policies: %w", esErrorString(err))
 	}

 	if conf.Debug {
@@ -99,15 +102,16 @@ func IlmList(conf *cfg.Config, pattern string) error {
 	}

 	table.Sort()
+
 	return table.Print()
 }

 func IlmShow(conf *cfg.Config, policy string) error {
-	res, err := conf.DefaultCluster.ES.Ilm.GetLifecycle().
+	res, err := conf.DefaultCluster.ES().Ilm.GetLifecycle().
 		Policy(policy).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm status: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm status: %w", esErrorString(err))
 	}

 	if conf.Debug {
@@ -119,10 +123,14 @@ func IlmShow(conf *cfg.Config, policy string) error {
 		return errors.New("no ilm policy retrieved")
 	}

+	if conf.Ilm.Tree {
+		return IlmShowTree(conf, ilm.Policy)
+	}
+
 	table := printer.NewTable(conf, 2, 5)
 	table.Addheaders("ilm policy setting", "value")

-	table.Entries = [][]string{
+	table.Entries = [][]any{
 		{"policy", policy},
 		{"hot phase", ilmPhaseString(ilm.Policy.Phases.Hot, false)},
 		{"warm phase", ilmPhaseString(ilm.Policy.Phases.Warm, false)},
@@ -133,6 +141,102 @@ func IlmShow(conf *cfg.Config, policy string) error {
 	return table.Print()
 }

+// Visualize  phases or  a ILM  policy, taking  into account  that the
+// minAge for the current phases is set in the next phase
+func IlmShowTree(conf *cfg.Config, ilm types.IlmPolicy) error {
+	indent := ""
+
+	table := printer.NewTable(conf, 4, 0)
+	table.Addheaders("phase", "min age", "min size", "snapshot repo")
+
+	for _, phase := range IlmPhaseOrder {
+		if phase == "hot" {
+			fmt.Printf("%s%s phase:\n%s      rollover after %s\n",
+				indent, phase,
+				indent, formatDuration(parseDuration(ilm.Phases.Hot.Actions.Rollover.MaxAge.(string))),
+			)
+
+			if ilm.Phases.Hot.Actions.Rollover.MaxPrimaryShardSize != "" {
+				fmt.Printf("%s      rollover when storage > %s\n",
+					indent, ilm.Phases.Hot.Actions.Rollover.MaxPrimaryShardSize)
+			}
+
+			if ilm.Phases.Hot.Actions.Rollover.MaxDocs != nil {
+				fmt.Printf("%s      rollover docs > %d\n",
+					indent, *ilm.Phases.Hot.Actions.Rollover.MaxDocs)
+			}
+
+			indent += "    "
+
+			continue
+		}
+
+		current := getIlmCurrentPhase(ilm, phase)
+
+		if current == nil {
+			continue
+		}
+
+		next := findNextPhase(ilm, phase)
+
+		fmt.Printf("%s%s phase:\n", indent, phase)
+
+		if next != nil {
+			fmt.Printf("%s      rollover after %s\n",
+				indent, formatDuration(next.minage),
+			)
+
+			if current.Actions.SearchableSnapshot != nil {
+				fmt.Printf("%s      roll to snapshot repo: %s\n",
+					indent, current.Actions.SearchableSnapshot.SnapshotRepository)
+			}
+
+			if current.Actions.Forcemerge != nil {
+				fmt.Printf("%s      force merge segments: %d\n",
+					indent, current.Actions.Forcemerge.MaxNumSegments)
+			}
+
+			if current.Actions.Shrink != nil {
+				fmt.Printf("%s      shrink shards: %d\n",
+					indent, *current.Actions.Shrink.NumberOfShards)
+			}
+
+			if current.Actions.SetPriority != nil {
+				fmt.Printf("%s      priority: %d\n",
+					indent, *current.Actions.SetPriority.Priority)
+			}
+
+			if current.Actions.Delete != nil && current.Actions.Delete.DeleteSearchableSnapshot != nil {
+				fmt.Printf("%s      delete searchable snapshots: %t\n",
+					indent, *current.Actions.Delete.DeleteSearchableSnapshot)
+			}
+		}
+
+		if phase == "delete" {
+			fmt.Printf("%s      delete immediately\n", indent)
+		}
+
+		indent += "    "
+	}
+
+	return nil
+}
+
+func getIlmCurrentPhase(policy types.IlmPolicy, currentPhase string) *types.Phase {
+	switch currentPhase {
+	case "hot":
+		return policy.Phases.Hot
+	case "warm":
+		return policy.Phases.Warm
+	case "cold":
+		return policy.Phases.Cold
+	case "frozen":
+		return policy.Phases.Frozen
+	default:
+		return policy.Phases.Delete
+	}
+}
+
 func ilmPhaseString(phase *types.Phase, short bool) string {
 	if phase == nil {
 		return ""
@@ -158,17 +262,17 @@ func ilmPhaseString(phase *types.Phase, short bool) string {
 	}

 	if phase.Actions.SearchableSnapshot != nil {
-		out = append(out, fmt.Sprintf("searchable-snapshot:%s", phase.Actions.SearchableSnapshot.SnapshotRepository))
+		out = append(out, "searchable-snapshot:"+phase.Actions.SearchableSnapshot.SnapshotRepository)
 	}

 	return strings.Join(out, ",")
 }

 func IlmExplain(conf *cfg.Config, index string) error {
-	res, err := conf.DefaultCluster.ES.Ilm.ExplainLifecycle(index).
+	res, err := conf.DefaultCluster.ES().Ilm.ExplainLifecycle(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get ilm state: %s", esErrorString(err))
+		return fmt.Errorf("failed to get ilm state: %w", esErrorString(err))
 	}

 	slog.Debug("ilm status", "ilm", res)
@@ -183,32 +287,83 @@ func IlmExplain(conf *cfg.Config, index string) error {
 	table := printer.NewTable(conf, 2, 0)
 	table.Addheaders("ilm status field", "value")

-	table.Entries = [][]string{
+	info := ""
+
+	err = json.Unmarshal(ilm.StepInfo["reason"], &info)
+	if err != nil {
+		return fmt.Errorf("failed to unmarshal step info: %w", err)
+	}
+
+	table.Entries = [][]any{
 		{"index", ilm.Index},
 		{"ilm policy", *ilm.Policy},
 		{"action", *ilm.Action},
-		{"step", *ilm.Step},
-		{"age", fmt.Sprintf("%s", ilm.Age)},
-		{"managed", fmt.Sprintf("%t", ilm.Managed)},
+		{"age", ilm.Age},
+		{"managed", ilm.Managed},
 		{"phase", *ilm.Phase},
 		{"phase execution", ilmPhaseString(ilm.PhaseExecution.PhaseDefinition, false)},
+		{"step", *ilm.Step},
+		{"failed step", *ilm.FailedStep},
+		{"failed step retry count", ilm.FailedStepRetryCount},
 	}

-	return table.Print()
+	if err := table.Print(); err != nil {
+		return err
+	}
+
+	if info != "" {
+		var bold = lipgloss.NewStyle().Bold(true)
+
+		fmt.Printf("\n%s:\n%s\n",
+			bold.Render("Step Reason"),
+			info)
+	}
+
+	return nil
 }

 func IlmCreate(conf *cfg.Config, policyname string) error {
-	ilm := conf.DefaultCluster.ES.Ilm.PutLifecycle(policyname)
+	var policy *types.IlmPolicy = nil
+
+	res, err := conf.DefaultCluster.ES().Ilm.GetLifecycle().
+		Policy(policyname).
+		Do(context.Background())
+	if err == nil {
+		if conf.Debug {
+			repr.Println(res)
+		}
+
+		ilm, exists := res[policyname]
+		if !exists {
+			return errors.New("no ilm policy retrieved")
+		}
+
+		policy = &ilm.Policy
+	}
+
+	ilm := conf.DefaultCluster.ES().Ilm.PutLifecycle(policyname)
 	cfg := conf.Ilm

 	var phases types.PhasesVariant = esdsl.NewPhases()

 	if cfg.HaveHot() {
 		hot := types.Phase{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
+
 		rollover := &types.RolloverAction{}
 		haveroll := false

+		if policy != nil {
+			// update
+			actions = policy.Phases.Hot.Actions
+
+			if policy.Phases.Hot.Actions.Rollover != nil {
+				rollover = policy.Phases.Hot.Actions.Rollover
+				haveroll = true
+			}
+		}
+
 		if cfg.HotMinAge != "" {
 			hot.MinAge = cfg.HotMinAge
 		}
@@ -223,7 +378,7 @@ func IlmCreate(conf *cfg.Config, policyname string) error {
 			haveroll = true
 		}

-		if cfg.HotRolloverMaxPrimaryShardSize != 0 {
+		if cfg.HotRolloverMaxPrimaryShardSize != "" {
 			rollover.MaxPrimaryShardSize = &cfg.HotRolloverMaxPrimaryShardSize
 		}

@@ -233,12 +388,21 @@ func IlmCreate(conf *cfg.Config, policyname string) error {

 		hot.Actions = actions.IlmActionsCaster()
 		phases.PhasesCaster().Hot = &hot
+	} else if policy != nil {
+		// update
+		phases.PhasesCaster().Hot = policy.Phases.Hot
 	}

 	if cfg.HaveWarm() {
 		warm := types.Phase{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()

+		if policy != nil {
+			// update
+			actions = policy.Phases.Warm.Actions
+		}
+
 		if cfg.WarmForceMerge != 0 {
 			actions.IlmActionsCaster().Forcemerge = &types.ForceMergeAction{MaxNumSegments: cfg.WarmForceMerge}
 		}
@@ -257,21 +421,82 @@ func IlmCreate(conf *cfg.Config, policyname string) error {

 		warm.Actions = actions.IlmActionsCaster()
 		phases.PhasesCaster().Warm = &warm
+	} else if policy != nil && policy.Phases.Warm != nil {
+		// update
+		phases.PhasesCaster().Warm = policy.Phases.Warm
+	}
+
+	if cfg.HaveCold() {
+		cold := types.Phase{}
+
+		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
+
+		if policy != nil {
+			// update
+			actions = policy.Phases.Cold.Actions
+		}
+
+		if cfg.ColdForceMerge != 0 {
+			actions.IlmActionsCaster().Forcemerge = &types.ForceMergeAction{MaxNumSegments: cfg.ColdForceMerge}
+		}
+
+		if cfg.ColdMinAge != "" {
+			cold.MinAge = cfg.ColdMinAge
+		}
+
+		if cfg.ColdPriority != 0 {
+			actions.IlmActionsCaster().SetPriority = &types.SetPriorityAction{Priority: &cfg.ColdPriority}
+		}
+
+		if cfg.ColdSearchableSnapshotRepo != "" {
+			actions.IlmActionsCaster().SearchableSnapshot =
+				&types.SearchableSnapshotAction{SnapshotRepository: cfg.ColdSearchableSnapshotRepo}
+		}
+
+		cold.Actions = actions.IlmActionsCaster()
+		phases.PhasesCaster().Cold = &cold
+	} else if policy != nil && policy.Phases.Cold != nil {
+		// update
+		phases.PhasesCaster().Cold = policy.Phases.Cold
 	}

 	if cfg.HaveFrozen() {
-		froze := phases.PhasesCaster().Frozen
+		froze := types.Phase{}
+
+		var actions types.IlmActionsVariant = esdsl.NewIlmActions()
+
+		if policy != nil {
+			// update
+			actions = policy.Phases.Frozen.Actions
+		}

 		if cfg.FrozenMinAge != "" {
 			froze.MinAge = cfg.FrozenMinAge
 		}
+
+		if cfg.FrozenSearchableSnapshotRepo != "" {
+			actions.IlmActionsCaster().SearchableSnapshot =
+				&types.SearchableSnapshotAction{SnapshotRepository: cfg.FrozenSearchableSnapshotRepo}
+		}
+
+		froze.Actions = actions.IlmActionsCaster()
+		phases.PhasesCaster().Frozen = &froze
+	} else if policy != nil && policy.Phases.Frozen != nil {
+		// update
+		phases.PhasesCaster().Frozen = policy.Phases.Frozen
 	}

 	if cfg.HaveDelete() {
-		del := phases.PhasesCaster().Delete
+		del := types.Phase{}
 		delete := types.DeleteAction{}
+
 		var actions types.IlmActionsVariant = esdsl.NewIlmActions()

+		if policy != nil {
+			// update
+			actions = policy.Phases.Delete.Actions
+		}
+
 		if cfg.DeleteMinAge != "" {
 			del.MinAge = cfg.DeleteMinAge
 		}
@@ -282,19 +507,22 @@ func IlmCreate(conf *cfg.Config, policyname string) error {

 		actions.IlmActionsCaster().Delete = &delete
 		del.Actions = actions.IlmActionsCaster()
-		phases.PhasesCaster().Delete = del
+		phases.PhasesCaster().Delete = &del
+	} else if policy != nil && policy.Phases.Delete != nil {
+		// update
+		phases.PhasesCaster().Delete = policy.Phases.Delete
 	}

 	put := &putlifecycle.Request{}
-	policy := &types.IlmPolicy{}
-	policy.IlmPolicyCaster().Phases = *phases.PhasesCaster()
-	put.Policy = policy
+	newpolicy := &types.IlmPolicy{}
+	newpolicy.IlmPolicyCaster().Phases = *phases.PhasesCaster()
+	put.Policy = newpolicy

 	ilm.Request(put)

-	_, err := ilm.Do(context.Background())
+	_, err = ilm.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed create ilm policy: %s", esErrorString(err))
+		return fmt.Errorf("failed create ilm policy: %w", esErrorString(err))
 	}

 	return nil
--- a/pkg/es/ilm_forecast.go
+++ b/pkg/es/ilm_forecast.go
@@ -0,0 +1,391 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/dustin/go-humanize"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/explainlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/getlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+)
+
+var (
+	IlmPhaseOrder = []string{"hot", "warm", "cold", "frozen", "delete"}
+)
+
+type NextPhase struct {
+	minage      time.Duration
+	minsize     int64
+	phase       string
+	previousHot bool
+}
+
+type PhaseData struct {
+	index                   string
+	policy                  string
+	size                    int64
+	age                     time.Duration
+	minage                  time.Duration
+	minsize                 int64
+	currentPhase, nextPhase string
+}
+
+/*
+	ilm stages:
+
+types.Lifecycle{
+
+		  Policy: types.IlmPolicy{
+		    Phases: types.Phases{
+		      Hot: &types.Phase{
+		        Actions: &types.IlmActions{
+		          Rollover: &types.RolloverAction{
+		            MaxAge: "7d",
+		            MaxPrimaryShardSize: "25gb",
+		          },
+		        },
+		        MinAge: "0ms",
+		      },
+		      Warm: &types.Phase{
+		        MinAge: "0d",
+		      },
+			  Frozen: &types.Phase{
+		        MinAge: "14d",
+			  },
+			  Delete: &types.Phase{
+		        MinAge: "60d",
+		      },
+		    },
+		  },
+		  }
+
+	   hot for 7 days or 25Gig, then Rollover => warm 14 days => frozen 60 days => delete
+*/
+
+func IlmForecastList(conf *cfg.Config, filter string) error {
+	phaseData, err := getIlmPhaseData(conf)
+	if err != nil {
+		return err
+	}
+
+	flt := regexp.MustCompile(filter)
+
+	minage := time.Duration(0)
+	if conf.Ilm.MinAge != "" {
+		minage = parseDuration(conf.Ilm.MinAge)
+	}
+
+	headers := []string{"index", "current size", "current age",
+		"virtual age", "min age", "min size", "current phase", "next phase"}
+	if conf.Verbose {
+		headers = append(headers, "ilm policy")
+	}
+
+	table := printer.NewTable(conf, len(headers), 0)
+	table.Addheaders(headers...)
+
+	for _, phase := range phaseData {
+		if filter != "" && !flt.MatchString(phase.index) {
+			continue
+		}
+
+		if conf.Ilm.MinAge != "" && phase.age < minage {
+			continue
+		}
+
+		virtualAge := virtualAge(&phase)
+
+		row := []any{
+			phase.index,
+			printer.Bytes(phase.size),
+			formatDuration(phase.age),
+			formatDuration(virtualAge),
+			formatDuration(phase.minage),
+			printer.Bytes(phase.minsize),
+			phase.currentPhase,
+			phase.nextPhase,
+		}
+
+		if conf.Verbose {
+			row = append(row, phase.policy)
+		}
+
+		table.AddRow(row...)
+	}
+
+	table.Sort()
+
+	return table.Print()
+}
+
+// Loop  over   all  current  index   phases  of  the   current  phase
+// (conf.Ilm.FromPhase). Calculate virtualAge  if phase.minsize >0. If
+// the actual age is smaller than the virtual age, use this as a base,
+// otherwise use virtual  age. Then look if the  rollover would happen
+// within the phase.minage window  (conf.Ilm.Within + current age) and
+// add the size.
+func IlmForecastShow(conf *cfg.Config) error {
+	phaseData, err := getIlmPhaseData(conf)
+	if err != nil {
+		return err
+	}
+
+	within := parseDuration(conf.Ilm.Within)
+
+	var toBeFreed int64 = 0
+
+	for _, phase := range phaseData {
+		age := max(virtualAge(&phase), phase.age)
+
+		if age+within >= phase.minage {
+			toBeFreed += phase.size
+		}
+	}
+
+	fmt.Printf("%s bytes of data in %s phase will be rolled within %s to the next phase\n",
+		humanize.Bytes(uint64(toBeFreed)),
+		conf.Ilm.FromPhase,
+		within)
+
+	return nil
+}
+
+func virtualAge(phase *PhaseData) time.Duration {
+	if phase.minsize == 0 {
+		return time.Duration(0)
+	}
+
+	return phase.minage * time.Duration(100*phase.size/phase.minsize) / 100
+}
+
+// Retrieve all index, ilm-explain and ilm-policies in parallel
+func getIlmPhaseData(conf *cfg.Config) ([]PhaseData, error) {
+	responses := make(chan apiResponse, 3)
+	wg := &sync.WaitGroup{}
+	wg.Add(3)
+
+	go getApiData(conf, conf.DefaultCluster.ES(), wg, responses, "indicesbytes")
+	go getApiData(conf, conf.DefaultCluster.ES(), wg, responses, "explain")
+	go getApiData(conf, conf.DefaultCluster.ES(), wg, responses, "policies")
+
+	wg.Wait()
+
+	var (
+		ilmdetails  *explainlifecycle.Response
+		indicesres  *indices.Response
+		ilmpolicies getlifecycle.Response
+	)
+
+	for range 3 {
+		res := <-responses
+
+		if res.error != nil {
+			return nil, res.error
+		}
+
+		switch res.which {
+		case ResponseExplain:
+			ilmdetails = res.explainlifecycle
+		case ResponseIndices:
+			indicesres = res.indicesbytes
+		case ResponseLifecycle:
+			ilmpolicies = *res.lifecycle
+		}
+	}
+
+	list := []PhaseData{}
+
+	indices := make(map[string]types.IndicesRecord)
+	for _, index := range *indicesres {
+		indices[*index.Index] = index
+	}
+
+	for indexName, explain := range ilmdetails.Indices {
+		if !conf.Hidden && strings.HasPrefix(indexName, ".") {
+			continue
+		}
+
+		// avoid types.LifecycleExplainUnmanaged casting error
+		switch explain.(type) {
+		case *types.LifecycleExplainManaged:
+		default:
+			continue
+		}
+
+		explain := explain.(*types.LifecycleExplainManaged)
+
+		if explain.Phase == nil {
+			continue
+		}
+
+		phase := *explain.Phase
+
+		if phase != conf.Ilm.FromPhase {
+			continue
+		}
+
+		size, err := strconv.ParseInt(*indices[indexName].DatasetSize, 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert index.DatasetSize to int: %w", err)
+		}
+
+		age := time.Duration(*explain.AgeInMillis * int64(time.Millisecond))
+
+		policy := ilmpolicies[*explain.Policy].Policy
+
+		nextPhase := findNextPhase(policy, phase)
+		if nextPhase == nil {
+			continue
+		}
+
+		list = append(list, PhaseData{
+			index:        indexName,
+			policy:       *explain.Policy,
+			size:         size,
+			age:          age,
+			minage:       nextPhase.minage,
+			minsize:      nextPhase.minsize,
+			currentPhase: conf.Ilm.FromPhase,
+			nextPhase:    nextPhase.phase,
+		})
+	}
+
+	return list, nil
+}
+
+func registerPhases(policy types.IlmPolicy, currentPhase string) (map[string]*types.Phase, int) {
+	// register phases configured in the policy
+	phases := map[string]*types.Phase{
+		"hot":    nil,
+		"warm":   nil,
+		"cold":   nil,
+		"frozen": nil,
+		"delete": nil,
+	}
+
+	// looking for a defined previous phase
+	start := 0
+
+	// register phases
+	for idx, phase := range IlmPhaseOrder {
+		switch phase {
+		case "hot":
+			if policy.Phases.Hot != nil {
+				phases[phase] = policy.Phases.Hot
+			}
+
+		case "warm":
+			if policy.Phases.Warm != nil {
+				phases[phase] = policy.Phases.Warm
+			}
+
+		case "cold":
+			if policy.Phases.Cold != nil {
+				phases[phase] = policy.Phases.Cold
+			}
+
+		case "frozen":
+			if policy.Phases.Frozen != nil {
+				phases[phase] = policy.Phases.Frozen
+			}
+
+		case "delete":
+			if policy.Phases.Delete != nil {
+				phases[phase] = policy.Phases.Delete
+			}
+		}
+
+		if phase == currentPhase {
+			start = idx
+		}
+	}
+
+	return phases, start
+}
+
+func findNextPhase(policy types.IlmPolicy, currentPhase string) *NextPhase {
+	// phase list to determine which comes next
+	phases, start := registerPhases(policy, currentPhase)
+
+	nextPhase := &NextPhase{}
+
+	// finally determine which phase comes next
+	// exception: hot, where we look for rollover rules
+	for idx, phase := range IlmPhaseOrder {
+		if idx < start {
+			continue
+		}
+
+		if phase == "hot" {
+			// if we're starting here, do not look for the next phase
+			maxage := parseDuration(phases[phase].Actions.Rollover.MaxAge.(string))
+
+			var maxsize int64 = 0
+
+			switch val := phases[phase].Actions.Rollover.MaxPrimaryShardSize.(type) {
+			case int64:
+				maxsize = val
+			case string:
+				size, err := humanize.ParseBytes(val)
+				if err != nil {
+					panic(err)
+				}
+
+				maxsize = int64(size)
+			}
+
+			nextPhase.minage = maxage
+			nextPhase.minsize = maxsize
+			nextPhase.previousHot = true
+
+			continue
+		}
+
+		if phase == currentPhase {
+			continue // use the next one
+		}
+
+		if phases[phase] == nil {
+			continue // skip it, since empty
+		}
+
+		nextPhase.phase = phase
+
+		if nextPhase.previousHot {
+			return nextPhase
+		}
+
+		minage := parseDuration(phases[phase].MinAge.(string))
+
+		nextPhase.minage = minage
+		nextPhase.minsize = 0
+
+		return nextPhase
+	}
+
+	return nil
+}
--- a/pkg/es/index.go
+++ b/pkg/es/index.go
@@ -18,6 +18,8 @@ package es

 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"regexp"
@@ -28,6 +30,7 @@ import (

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
+	"github.com/charmbracelet/lipgloss"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/healthstatus"
@@ -35,13 +38,10 @@ import (

 // used for completion
 func IndexNames(conf *cfg.Config) ([]string, error) {
-	res, err := conf.DefaultCluster.ES.Cat.Indices().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Cat.Indices().
 		Do(context.Background())
-
 	if err != nil {
-		return nil, fmt.Errorf("failed to get indicies: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get indicies: %w", esErrorString(err))
 	}

 	indices := make([]string, len(res))
@@ -55,11 +55,16 @@ func IndexNames(conf *cfg.Config) ([]string, error) {
 func filterIndices(conf *cfg.Config, list indices.Response) indices.Response {
 	// apply partials filter first
 	selectedlist := indices.Response{}
+
 	for _, index := range list {
 		if !conf.Partials && strings.HasPrefix(*index.Index, "partial-") {
 			continue
 		}

+		if !conf.Hidden && strings.HasPrefix(*index.Index, ".") {
+			continue
+		}
+
 		if strings.HasPrefix(*index.Index, ".ds-") {
 			// ignore data stream backing indicies
 			continue
@@ -86,10 +91,7 @@ func filterIndices(conf *cfg.Config, list indices.Response) indices.Response {
 }

 func IndexList(conf *cfg.Config) error {
-	cat := conf.DefaultCluster.ES.Cat.Indices().
-		// we need to add custom request headers, required for older ES instances
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
+	cat := conf.DefaultCluster.ES().Cat.Indices()

 	if conf.Failed {
 		cat = cat.Health(healthstatus.Red)
@@ -97,7 +99,7 @@ func IndexList(conf *cfg.Config) error {

 	res, err := cat.Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get indicies: %s", esErrorString(err))
+		return fmt.Errorf("failed to get indicies: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "indicies", res)
@@ -118,7 +120,7 @@ func IndexList(conf *cfg.Config) error {
 	for idx, index := range list {
 		name := printer.Colorize(conf, *index.Health, *index.Index)

-		table.Entries[idx] = []string{name, *index.DatasetSize, *index.DocsCount}
+		table.Entries[idx] = []any{name, *index.DatasetSize, *index.DocsCount}

 		if idx == size-1 {
 			break
@@ -126,28 +128,29 @@ func IndexList(conf *cfg.Config) error {
 	}

 	table.Sort()
+
 	return table.Print()
 }

 func IndexShow(conf *cfg.Config, indexpattern string) error {
-	res, err := conf.DefaultCluster.ES.Indices.Get(indexpattern).
-		// we need to add custom request headers, required for older ES instances
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Indices.Get(indexpattern).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get index: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index: %w", esErrorString(err))
 	}

+	slog.Debug("index show", "index", res)
+
 	for name, index := range res {
 		fields := make([]string, len(index.Mappings.Properties))
+
 		idx := 0
 		for field := range index.Mappings.Properties {
 			fields[idx] = field
 			idx++
 		}

-		table := printer.NewTable(conf, 2, 5)
+		table := printer.NewTable(conf, 2, 7)
 		table.Addheaders("index property", "value")

 		ts, err := strconv.ParseInt(index.Settings.Index.CreationDate.(string), 10, 64)
@@ -157,13 +160,21 @@ func IndexShow(conf *cfg.Config, indexpattern string) error {

 		created := time.Unix(ts/1000, 0)

-		table.Entries = [][]string{
+		table.Entries = [][]any{
 			{"name", name},
 			{"replicas", *index.Settings.Index.NumberOfReplicas},
 			{"shards", *index.Settings.Index.NumberOfShards},
-			{"created", created.Format("2006-01-02 15:04:05")},
+			{"created", created},
 			{"uuid", *index.Settings.Index.Uuid},
-			{"fields", strings.Join(fields, ",")},
+			{"version", *index.Settings.Index.Version.Created},
+			{"fields", fields},
+		}
+
+		if index.Settings.Index.Lifecycle != nil {
+			table.Entries = append(table.Entries, [][]any{
+				{"ilm policy", *index.Settings.Index.Lifecycle.Name},
+				{"ilm rollover alias", *index.Settings.Index.Lifecycle.RolloverAlias},
+			}...)
 		}

 		if err := table.Print(); err != nil {
@@ -179,19 +190,18 @@ func IndexShow(conf *cfg.Config, indexpattern string) error {
 func IndexCreate(conf *cfg.Config, index string, mappings []string) error {
 	settings := esdsl.NewIndexSettings()

-	create := conf.DefaultCluster.ES.Indices.Create(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
+	create := conf.DefaultCluster.ES().Indices.Create(index)

 	if conf.Wait {
 		create.WaitForActiveShards("all")
 	}

 	if conf.Shards > 0 {
-		settings = settings.NumberOfShards(strconv.Itoa(conf.Shards))
+		settings.NumberOfShards(strconv.Itoa(conf.Shards))
 	}
+
 	if conf.Replicas > 0 {
-		settings = settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
+		settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
 	}

 	if len(mappings) > 0 {
@@ -218,117 +228,56 @@ func IndexCreate(conf *cfg.Config, index string, mappings []string) error {
 		create.Mappings(maps)
 	}

+	if conf.Policy != "" {
+		settings.Lifecycle(
+			esdsl.NewIndexSettingsLifecycle().
+				Name(conf.Policy).
+				RolloverAlias(index))
+	}
+
 	_, err := create.Settings(settings).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create index: %s", esErrorString(err))
+		return fmt.Errorf("failed to create index: %w", esErrorString(err))
 	}

 	return nil
 }

 func IndexDelete(conf *cfg.Config, index string) error {
-	_, err := conf.DefaultCluster.ES.Indices.Delete(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	_, err := conf.DefaultCluster.ES().Indices.Delete(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to delete index: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete index: %w", esErrorString(err))
 	}

 	return nil
 }

 func IndexClose(conf *cfg.Config, index string) error {
-	create := conf.DefaultCluster.ES.Indices.Close(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
-
-	_, err := create.Do(context.Background())
-
-	if err != nil {
-		return fmt.Errorf("failed to close index: %s", esErrorString(err))
-	}
-
-	return nil
-}
-
-func IndexAllocation(conf *cfg.Config, index string) error {
-	res, err := conf.DefaultCluster.ES.Cluster.AllocationExplain().
-		Index(index).
-		Primary(conf.Primary).
-		Shard(conf.Shards).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	_, err := conf.DefaultCluster.ES().Indices.Close(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get index allocation explain: %s", esErrorString(err))
-	}
-
-	slog.Debug("ES result", "index", res)
-
-	currentNode := res.CurrentNode
-
-	table := printer.NewTable(conf, 2, 10)
-	table.Addheaders("index allocation setting", "value")
-
-	roles := make([]string, len(currentNode.Roles))
-	for idx, role := range currentNode.Roles {
-		roles[idx] = role.Name
-	}
-
-	table.Entries = [][]string{
-		{"Index", index},
-		{"Current node", currentNode.Name},
-		{"Current k8s node", currentNode.Attributes["k8s_node_name"]},
-		{"Current node address", currentNode.TransportAddress},
-		{"Current node id", currentNode.Id},
-		{"Current node weight", fmt.Sprintf("%d", currentNode.WeightRanking)},
-		{"Current node roles", strings.Join(roles, ",")},
-		{"Can rebalance cluster", res.CanRebalanceCluster.Name},
-		{"Can rebalance to another node", res.CanRebalanceToOtherNode.Name},
-		{"Can remain on current node", res.CanRemainOnCurrentNode.Name},
-	}
-
-	if err := table.Print(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func IndexModify(conf *cfg.Config, index string) error {
-	settings := esdsl.NewIndexSettings().NumberOfReplicas(strconv.Itoa(conf.Replicas))
-
-	_, err := conf.DefaultCluster.ES.Indices.PutSettings().
-		Indices(index).
-		Index(settings).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
-		Do(context.Background())
-	if err != nil {
-		return fmt.Errorf("failed to modify index settings: %s", esErrorString(err))
+		return fmt.Errorf("failed to close index: %w", esErrorString(err))
 	}

 	return nil
 }

 func IndexFields(conf *cfg.Config, index string) error {
-	res, err := conf.DefaultCluster.ES.FieldCaps().
+	res, err := conf.DefaultCluster.ES().FieldCaps().
 		Index(index).
 		Fields("*").
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to retrieve field capabilties: %s", esErrorString(err))
+		return fmt.Errorf("failed to retrieve field capabilties: %w", esErrorString(err))
 	}

 	table := printer.NewTable(conf, 5, 0)
 	table.Addheaders("field", "type", "searchable", "aggretable", "metadata")

 	idx := 0
+
 	for name, field := range res.Fields {
 		for fieldtype, caps := range field {
 			// fields only have 1 type, so this one is it
@@ -341,10 +290,11 @@ func IndexFields(conf *cfg.Config, index string) error {
 				continue
 			}

-			table.Entries = append(table.Entries, []string{name, fieldtype,
-				fmt.Sprintf("%t", caps.Searchable),
-				fmt.Sprintf("%t", caps.Aggregatable),
-				fmt.Sprintf("%t", *caps.MetadataField)})
+			table.AddRow(name, fieldtype,
+				caps.Searchable,
+				caps.Aggregatable,
+				*caps.MetadataField)
+
 			break
 		}

@@ -359,3 +309,79 @@ func IndexFields(conf *cfg.Config, index string) error {

 	return nil
 }
+
+type Diskusage struct {
+	Total       int64 `json:"total_in_bytes"`
+	Points      int64 `json:"points_in_bytes"`
+	Norms       int64 `json:"norms_in_bytes"`
+	TermVectors int64 `json:"term_vectors_in_bytes"`
+	KnnVectors  int64 `json:"knn_vectors_in_bytes"`
+	BloomFilter int64 `json:"bloom_filter_in_bytes"`
+}
+
+type IndexDiskUsage struct {
+	AllFields Diskusage            `json:"all_fields"`
+	Fields    map[string]Diskusage `json:"fields"`
+}
+
+type ResIndexDiskUsage map[string]IndexDiskUsage
+
+func IndexDiskusage(conf *cfg.Config, index string) error {
+	var bold = lipgloss.NewStyle().Bold(true)
+
+	res, err := conf.DefaultCluster.ES().Indices.DiskUsage(index).
+		RunExpensiveTasks(true).
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to retrieve index disk usage: %w", esErrorString(err))
+	}
+
+	duRes := ResIndexDiskUsage{}
+	if err := json.Unmarshal(res, &duRes); err != nil {
+		return fmt.Errorf("failed to unmarshal disk usage response: %w", err)
+	}
+
+	diskusage, exists := duRes[index]
+	if !exists {
+		return errors.New("no disk usage reported for index")
+	}
+
+	table := printer.NewTableEmpty(conf).
+		WithHeaders("field", "bloom filter", "norms", "points", "term vectors", "knn vectors", "total")
+
+	for name, field := range diskusage.Fields {
+		if strings.HasPrefix(name, "_") || strings.HasSuffix(name, ".keyword") {
+			continue
+		}
+
+		table.AddRow(
+			name,
+			printer.Bytes(field.BloomFilter),
+			printer.Bytes(field.Norms),
+			printer.Bytes(field.Points),
+			printer.Bytes(field.TermVectors),
+			printer.Bytes(field.KnnVectors),
+			printer.Bytes(field.Total),
+		)
+	}
+
+	all := diskusage.AllFields
+
+	table.Sort()
+
+	table.AddRowLate(
+		bold.Render("Summary"),
+		printer.Bytes(all.BloomFilter),
+		printer.Bytes(all.Norms),
+		printer.Bytes(all.Points),
+		printer.Bytes(all.TermVectors),
+		printer.Bytes(all.KnnVectors),
+		printer.Bytes(all.Total),
+	)
+
+	if err := table.Print(); err != nil {
+		return err
+	}
+
+	return nil
+}
--- a/pkg/es/index_alias.go
+++ b/pkg/es/index_alias.go
@@ -29,15 +29,13 @@ import (

 // FIXME: add filter support, see IndexCreate mapping
 func IndexAliasCreate(conf *cfg.Config, index, alias string) error {
-	res, err := conf.DefaultCluster.ES.Indices.PutAlias(index, alias).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Indices.PutAlias(index, alias).
 		Do(context.Background())

 	slog.Debug("create alias", "result", res)

 	if err != nil {
-		return fmt.Errorf("failed to create index alias: %s", esErrorString(err))
+		return fmt.Errorf("failed to create index alias: %w", esErrorString(err))
 	}

 	return nil
@@ -51,14 +49,11 @@ func IndexAliasList(conf *cfg.Config) error {
 		filter = *regexp.MustCompile(conf.Filter[0])
 	}

-	res, err := conf.DefaultCluster.ES.Indices.GetAlias().
+	res, err := conf.DefaultCluster.ES().Indices.GetAlias().
 		Index("_all").
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to list index aliases: %s", esErrorString(err))
+		return fmt.Errorf("failed to list index aliases: %w", esErrorString(err))
 	}

 	slog.Debug("aliases list", "result", res)
@@ -82,7 +77,7 @@ func IndexAliasList(conf *cfg.Config) error {

 	idx := 0
 	for index, aliases := range aliaslist {
-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			index,
 			strings.Join(aliases, ","),
 		}
@@ -100,15 +95,13 @@ func IndexAliasList(conf *cfg.Config) error {
 }

 func IndexAliasDelete(conf *cfg.Config, index, alias string) error {
-	res, err := conf.DefaultCluster.ES.Indices.DeleteAlias(index, alias).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Indices.DeleteAlias(index, alias).
 		Do(context.Background())

 	slog.Debug("delete alias", "result", res)

 	if err != nil {
-		return fmt.Errorf("failed to delete index alias: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete index alias: %w", esErrorString(err))
 	}

 	return nil
@@ -116,17 +109,16 @@ func IndexAliasDelete(conf *cfg.Config, index, alias string) error {

 func IndexAliasRollover(conf *cfg.Config, alias string) error {
 	res, err := RolloverAlias(conf, alias)
-
 	if err != nil {
-		return fmt.Errorf("failed to rollover index alias: %s", esErrorString(err))
+		return fmt.Errorf("failed to rollover index alias: %w", esErrorString(err))
 	}

 	table := printer.NewTable(conf, 2, 5)
 	table.Addheaders("rollover response", "value")
-	table.Entries = [][]string{
-		{"acknowledged", fmt.Sprintf("%t", res.Acknowledged)},
-		{"rolled over", fmt.Sprintf("%t", res.RolledOver)},
-		{"shards acknowledged", fmt.Sprintf("%t", res.ShardsAcknowledged)},
+	table.Entries = [][]any{
+		{"acknowledged", res.Acknowledged},
+		{"rolled over", res.RolledOver},
+		{"shards acknowledged", res.ShardsAcknowledged},
 		{"old index", res.OldIndex},
 		{"new index", res.NewIndex},
 	}
--- a/pkg/es/index_template.go
+++ b/pkg/es/index_template.go
@@ -22,6 +22,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"strconv"
 	"strings"

@@ -33,13 +34,10 @@ import (

 // used for completion
 func IndexTemplateList(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Indices.GetIndexTemplate().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index templates: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index templates: %w", esErrorString(err))
 	}

 	slog.Debug("res", "index templates", res)
@@ -53,26 +51,20 @@ func IndexTemplateList(conf *cfg.Config) error {
 			return fmt.Errorf("failed to unmarshal meta json data: %w", err)
 		}

-		table.Entries[idx] = []string{
-			tpl.Name,
-			string(desc),
-			fmt.Sprintf("%d", tpl.IndexTemplate.Priority),
-		}
+		table.Entries[idx] = []any{tpl.Name, desc, tpl.IndexTemplate.Priority}
 	}

 	table.Sort()
+
 	return table.Print()
 }

 func IndexTemplateShow(conf *cfg.Config, tplname string) error {
-	res, err := conf.DefaultCluster.ES.Indices.GetIndexTemplate().
+	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Name(tplname).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index template: %w", esErrorString(err))
 	}

 	slog.Debug("res", "index template", res)
@@ -98,13 +90,13 @@ func IndexTemplateShow(conf *cfg.Config, tplname string) error {
 		aliases = append(aliases, alias)
 	}

-	table.Entries = [][]string{
+	table.Entries = [][]any{
 		{"name", tpl.Name},
-		{"description", string(desc)},
-		{"index patterns", strings.Join(tpl.IndexTemplate.IndexPatterns, ",")},
-		{"composed of", strings.Join(tpl.IndexTemplate.ComposedOf, ",")},
-		{"data stream enabled", fmt.Sprintf("%t", hasds)},
-		{"aliases", strings.Join(aliases, ",")},
+		{"description", desc},
+		{"index patterns", tpl.IndexTemplate.IndexPatterns},
+		{"composed of", tpl.IndexTemplate.ComposedOf},
+		{"data stream enabled", hasds},
+		{"aliases", aliases},
 	}

 	if err := table.Print(); err != nil {
@@ -116,10 +108,11 @@ func IndexTemplateShow(conf *cfg.Config, tplname string) error {

 	err = getIndexTemplateSettings(conf, tplname, table)
 	if err != nil {
-		return nil
+		return err
 	}

 	fmt.Println()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -140,12 +133,11 @@ func IndexTemplateShow(conf *cfg.Config, tplname string) error {
 				typeval = val.Type
 			}

-			table.Entries = append(table.Entries, []string{
-				name, typeval,
-			})
+			table.AddRow(name, typeval)
 		}

 		fmt.Println()
+
 		if err := table.Print(); err != nil {
 			return err
 		}
@@ -158,16 +150,20 @@ func IndexTemplateCreate(conf *cfg.Config, name string, mappings []string) error
 	settings := esdsl.NewIndexSettings()
 	maps := esdsl.NewIndexTemplateMapping()

-	create := conf.DefaultCluster.ES.Indices.PutIndexTemplate(name).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
+	create := conf.DefaultCluster.ES().Indices.PutIndexTemplate(name)

 	if conf.Shards > 0 {
-		settings = settings.NumberOfShards(strconv.Itoa(conf.Shards))
+		settings.NumberOfShards(strconv.Itoa(conf.Shards))
 	}

 	if conf.Replicas > 0 {
-		settings = settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
+		settings.NumberOfReplicas(strconv.Itoa(conf.Replicas))
+	}
+
+	if conf.Policy != "" {
+		settings.Lifecycle(
+			esdsl.NewIndexSettingsLifecycle().
+				Name(conf.Policy))
 	}

 	if conf.Stream {
@@ -229,9 +225,8 @@ func IndexTemplateCreate(conf *cfg.Config, name string, mappings []string) error
 	create.IndexPatterns(conf.Patterns...)

 	_, err := create.Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to create index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to create index template: %w", esErrorString(err))
 	}

 	return nil
@@ -243,14 +238,11 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 	maps := esdsl.NewIndexTemplateMapping()

 	// load existing index mapping
-	res, err := conf.DefaultCluster.ES.Indices.GetIndexTemplate().
+	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Name(name).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index template: %w", esErrorString(err))
 	}

 	slog.Debug("res", "index template", res)
@@ -262,9 +254,7 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 	tpl := res.IndexTemplates[0]

 	// our modify PUT request
-	modify := conf.DefaultCluster.ES.Indices.PutIndexTemplate(name).
-		Header("content-type", "application/json").
-		Header("accept", "application/json")
+	modify := conf.DefaultCluster.ES().Indices.PutIndexTemplate(name)

 	// load existing settings, if any
 	settings := tpl.IndexTemplate.Template.Settings
@@ -294,6 +284,10 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 		*settings.Mode = conf.Mode
 	}

+	if conf.Policy != "" {
+		settings.Lifecycle.Name = &conf.Policy
+	}
+
 	if len(mappings) > 0 {
 		typemaps, err := modMappings(mappings)
 		if err != nil {
@@ -340,9 +334,8 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 	modify.IndexPatterns(patterns...)

 	_, err = modify.Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to modify index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to modify index template: %w", esErrorString(err))
 	}

 	if conf.Rollover {
@@ -355,12 +348,10 @@ func IndexTemplateModify(conf *cfg.Config, name string, mappings []string) error
 }

 func IndexTemplateDelete(conf *cfg.Config, name string) error {
-	_, err := conf.DefaultCluster.ES.Indices.DeleteIndexTemplate(name).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	_, err := conf.DefaultCluster.ES().Indices.DeleteIndexTemplate(name).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to delete index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to delete index template: %w", esErrorString(err))
 	}

 	return nil
@@ -370,12 +361,11 @@ func IndexTemplateDelete(conf *cfg.Config, name string) error {
 // find  indices matching  those,  find their  associated aliases  and
 // rollover all we find. Only run when conf.Rollover==true
 func rolloverAliasIndexTemplate(conf *cfg.Config, name string) error {
-	res, err := conf.DefaultCluster.ES.Indices.GetIndexTemplate().
+	res, err := conf.DefaultCluster.ES().Indices.GetIndexTemplate().
 		Name(name).
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index template: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index template: %w", esErrorString(err))
 	}

 	slog.Debug("res", "index template", res)
@@ -389,10 +379,10 @@ func rolloverAliasIndexTemplate(conf *cfg.Config, name string) error {

 	// find all aliases matching the patterns
 	for _, pattern := range patterns {
-		res, err := conf.DefaultCluster.ES.Indices.ResolveIndex(pattern).
+		res, err := conf.DefaultCluster.ES().Indices.ResolveIndex(pattern).
 			Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to resolve index pattern: %s", esErrorString(err))
+			return fmt.Errorf("failed to resolve index pattern: %w", esErrorString(err))
 		}

 		for _, index := range res.Indices {
@@ -416,12 +406,7 @@ func rolloverAliasIndexTemplate(conf *cfg.Config, name string) error {
 			return err
 		}

-		table.Entries = append(table.Entries, []string{
-			alias,
-			fmt.Sprintf("%t", res.RolledOver),
-			fmt.Sprintf("%t", res.Acknowledged),
-			res.NewIndex,
-		})
+		table.AddRow(alias, res.RolledOver, res.Acknowledged, res.NewIndex)

 		if err := table.Print(); err != nil {
 			return err
@@ -429,7 +414,6 @@ func rolloverAliasIndexTemplate(conf *cfg.Config, name string) error {
 	}

 	return nil
-
 }

 func modMappings(mappings []string) (types.TypeMappingVariant, error) {
@@ -461,9 +445,7 @@ func modMappings(mappings []string) (types.TypeMappingVariant, error) {
 func modMeta(conf *cfg.Config, meta types.Metadata) (map[string]json.RawMessage, error) {
 	metadata := map[string]json.RawMessage{}

-	for key, value := range meta {
-		metadata[key] = value
-	}
+	maps.Copy(metadata, meta)

 	for _, meta := range conf.Meta {
 		parts := strings.Split(meta, ":")
--- a/pkg/es/index_template_settings.go
+++ b/pkg/es/index_template_settings.go
@@ -28,7 +28,7 @@ type Tpl struct {
 }

 func getIndexTemplateSettings(conf *cfg.Config, tplname string, table *printer.Table) error {
-	raw, err := CallAPI(conf, "GET", "/_index_template/"+tplname, "")
+	raw, err := CallAPI(conf, "GET", "/_index_template/"+tplname+"?flat_settings", "")
 	if err != nil {
 		return err
 	}
@@ -39,9 +39,12 @@ func getIndexTemplateSettings(conf *cfg.Config, tplname string, table *printer.T
 	}

 	if conf.Debug {
-		if err := prettyfiJson(conf, raw); err != nil {
+		output, err := prettyfiJson(conf, raw)
+		if err != nil {
 			return err
 		}
+
+		fmt.Println(output)
 	}

 	if len(data.IndexTemplates) == 0 {
@@ -50,11 +53,7 @@ func getIndexTemplateSettings(conf *cfg.Config, tplname string, table *printer.T

 	tpl := data.IndexTemplates[0].IndexTemplate.Template.Settings
 	for topic, val := range tpl {
-		paths := getJsonPath(map[string]string{}, val.(map[string]any), topic)
-
-		for setting, value := range paths {
-			table.Entries = append(table.Entries, []string{setting, fmt.Sprintf("%v", value)})
-		}
+		table.AddRow(topic, val)
 	}

 	return nil
--- a/pkg/es/license.go
+++ b/pkg/es/license.go
@@ -0,0 +1,72 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"strconv"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+)
+
+func LicenseShow(conf *cfg.Config) error {
+	res, err := conf.DefaultCluster.ES().License.Get().
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get license: %w", esErrorString(err))
+	}
+
+	slog.Debug("license show", "license", res)
+
+	table := printer.NewTableEmpty(conf).WithHeaders("license setting", "value")
+
+	lic := res.License
+
+	var (
+		maxnodes = "infinite"
+		maxunits = "infinite"
+		expire   = "never"
+	)
+
+	if lic.MaxNodes != nil {
+		maxnodes = strconv.FormatInt(*lic.MaxNodes, 10)
+	}
+
+	if lic.ExpiryDate != nil {
+		expire = lic.ExpiryDate.(string)
+	}
+
+	if lic.MaxResourceUnits != nil {
+		maxunits = strconv.Itoa(*lic.MaxResourceUnits)
+	}
+
+	table.Entries = [][]any{
+		{"UID", lic.Uid},
+		{"Issued to", lic.IssuedTo},
+		{"Expires", expire},
+		{"Issued", lic.IssueDate},
+		{"Max nodes", maxnodes},
+		{"Max resource units", maxunits},
+		{"Type", lic.Type.Name},
+		{"Status", lic.Status.Name},
+	}
+
+	return table.Print()
+}
--- a/pkg/es/node.go
+++ b/pkg/es/node.go
@@ -20,6 +20,9 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"strconv"
+	"strings"
+	"time"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
@@ -27,32 +30,277 @@ import (

 func NodeList(conf *cfg.Config) error {
 	// get nodes
-	nodes, err := conf.DefaultCluster.ES.Cat.Nodes().Do(context.Background())
+	nodes, err := conf.DefaultCluster.ES().Cat.Nodes().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get nodes: %s", esErrorString(err))
+		return fmt.Errorf("failed to get nodes: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "nodes", nodes)

-	table := printer.NewTable(conf, 7, len(nodes))
-	table.Addheaders("name", "ip", "load1m", "load5m", "load15m", "ram %", "heap %")
+	table := printer.NewTableEmpty(conf).WithHeaders(
+		"name", "ip", "load1m", "load5m", "load15m", "ram %", "heap %")

-	for idx, node := range nodes {
-		table.Entries[idx] = []string{
+	for _, node := range nodes {
+		table.AddRow(
 			*node.Name,
 			*node.Ip,
 			*node.Load1M,
 			*node.Load5M,
 			*node.Load15M,
-			node.RamPercent.(string),
-			node.HeapPercent.(string),
-		}
+			node.RamPercent,
+			node.HeapPercent,
+		)
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}

 	return nil
 }
+
+func NodeNames(conf *cfg.Config) ([]string, error) {
+	nodes, err := conf.DefaultCluster.ES().Cat.Nodes().
+		Do(context.Background())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get nodes: %w", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "nodes", nodes)
+
+	nodelist := make([]string, len(nodes))
+
+	for idx, node := range nodes {
+		nodelist[idx] = *node.Name
+	}
+
+	return nodelist, err
+}
+
+// FIXME: adding the settings metric leads to json unmarshall error:
+// https://github.com/elastic/go-elasticsearch/issues/1524
+func NodeShow(conf *cfg.Config, nodename string) error {
+	res, err := conf.DefaultCluster.ES().Nodes.Info().
+		NodeId(nodename).
+		Metric("os, jvm, thread_pool, remote_cluster_server").
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get node info: %w", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "node", res)
+
+	stats, err := conf.DefaultCluster.ES().Nodes.Stats().
+		NodeId(nodename).
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get node stats: %w", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "stat", stats)
+
+	for id, info := range res.Nodes {
+		stat := stats.Nodes[id]
+
+		table := printer.NewTable(conf, 2, 0)
+		table.Addheaders(nodename+" property", "value")
+
+		roles := make([]string, len(info.Roles))
+		for idx, role := range info.Roles {
+			roles[idx] = role.Name
+		}
+
+		k8snode := info.Attributes["k8s_node_name"]
+		rank := "none"
+
+		adsel, exists := stat.AdaptiveSelection[id]
+		if exists {
+			rank = *adsel.Rank
+		}
+
+		table.Entries = [][]any{
+			{"Id", id},
+			{"Name", nodename},
+			{"Kubernetes node", k8snode},
+			{"Ip address", info.Ip},
+			{"Node rank", rank},
+			{"JVM", info.Jvm.VmName + " " + info.Jvm.Version},
+			{"JVM Started", time.UnixMilli(info.Jvm.StartTimeInMillis)},
+			{"OS", info.Os.PrettyName + " " + info.Os.Version},
+			{"Node roles", roles},
+			{"Node version", info.Version},
+			// FIXME: not implemented upstream
+			// see: https://github.com/elastic/go-elasticsearch/issues/1526
+			// {"Allocated shards", stat.Allocations.XXX},
+			{"HTTP clients", *stat.Http.CurrentOpen},
+			{"CPUs", *info.Os.AllocatedProcessors},
+			{"Load 15m/5m/1m", fmt.Sprintf("%.2f/%.2f/%.2f",
+				stat.Os.Cpu.LoadAverage["15m"],
+				stat.Os.Cpu.LoadAverage["5m"],
+				stat.Os.Cpu.LoadAverage["1m"],
+			)},
+			{"Open FD's", *stat.Process.OpenFileDescriptors},
+			{"HTTP sesssions current/total", fmt.Sprintf("%d/%d",
+				*stat.Http.CurrentOpen,
+				*stat.Http.TotalOpened,
+			)},
+			{"Traffic rx/tx",
+				printer.ByteString(*stat.Transport.RxSizeInBytes) + " / " + printer.ByteString(*stat.Transport.TxSizeInBytes)},
+			{"Response time avg", time.Duration(*stat.AdaptiveSelection[id].AvgResponseTimeNs)},
+			{"Memory usage (used/avail)",
+				printer.ByteString(*stat.Os.Mem.UsedInBytes) + " / " + printer.ByteString(*stat.Os.Mem.TotalInBytes)},
+			{"Search queries current/total", fmt.Sprintf("%d/%d",
+				stat.Indices.Search.QueryCurrent,
+				stat.Indices.Search.QueryTotal,
+			)},
+			{"Search efficiency", stat.Indices.Search.QueryTimeInMillis / stat.Indices.Search.QueryTotal},
+			{"Docs count", stat.Indices.Docs.Count},
+			{"Merges current/total", fmt.Sprintf("%d/%d",
+				stat.Indices.Merges.Current,
+				stat.Indices.Merges.Total,
+			)},
+			{"Merge docs count current/total", fmt.Sprintf("%d/%d",
+				stat.Indices.Merges.CurrentDocs,
+				stat.Indices.Merges.TotalDocs,
+			)},
+			{"Merge size current/total", fmt.Sprintf("%s/%s",
+				printer.ByteString(stat.Indices.Merges.CurrentSizeInBytes),
+				printer.ByteString(stat.Indices.Merges.TotalSizeInBytes),
+			)},
+			{"CircuitBreaker trip count", *stat.Breakers["fielddata"].Tripped},
+		}
+
+		if len(stat.Fs.Data) > 0 {
+			fs := stat.Fs.Data[0]
+			table.AddRow("Storage usage (used/avail)",
+				printer.ByteString(*fs.AvailableInBytes)+" / "+printer.ByteString(*fs.TotalInBytes))
+			table.AddRow("Storage mount", *fs.Mount)
+		}
+
+		if err := table.Print(); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func NodeClients(conf *cfg.Config, nodename string) error {
+	stats, err := conf.DefaultCluster.ES().Nodes.Stats().
+		NodeId(nodename).
+		Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get node stats: %w", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "stat", stats)
+
+	table := printer.NewTable(conf, 5, 0)
+	table.Addheaders("agent", "id", "when", "from host", "url")
+
+	for _, stat := range stats.Nodes {
+		for _, client := range stat.Http.Clients {
+			if client.ClosedTimeMillis == nil {
+				agent := ""
+				if client.Agent != nil {
+					agent = *client.Agent
+				}
+
+				uri := ""
+				if client.LastUri != nil {
+					uri = *client.LastUri
+
+					if !conf.All {
+						parts := strings.Split(uri, "?")
+						uri = parts[0]
+					}
+				}
+
+				table.AddRow(
+					agent,
+					strconv.FormatInt(*client.Id, 10),
+					time.UnixMilli(*client.LastRequestTimeMillis).String(),
+					*client.RemoteAddress,
+					uri,
+				)
+			}
+		}
+
+		break
+	}
+
+	table.Sort()
+
+	return table.Print()
+}
+
+func NodeUsage(conf *cfg.Config, nodeid string) error {
+	usage := conf.DefaultCluster.ES().Nodes.Usage()
+
+	if nodeid != "" {
+		usage.NodeId(nodeid)
+	}
+
+	stats, err := usage.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get node usage: %w", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "usage", stats)
+
+	table := printer.NewTableEmpty(conf).WithHeaders(
+		"node",
+		"bulk",
+		"doc get",
+		"doc mget",
+		"doc update",
+		"index doc",
+		"index stats",
+		"search",
+		"msearch",
+		"open pit",
+	)
+
+	for id, actions := range stats.Nodes {
+		node, err := getNodeName(conf, id)
+		if err != nil {
+			return err
+		}
+
+		stat := actions.RestActions
+
+		table.AddRow(
+			node,
+			stat["bulk_action"],
+			stat["document_get_action"],
+			stat["document_mget_action"],
+			stat["document_update_action"],
+			stat["document_index_action"],
+			stat["indices_stats_action"],
+			stat["search_action"],
+			stat["msearch_action"],
+			stat["open_point_in_time"],
+		)
+	}
+
+	return table.Print()
+}
+
+func getNodeName(conf *cfg.Config, id string) (string, error) {
+	res, err := conf.DefaultCluster.ES().Nodes.Info().
+		Metric("os").
+		Do(context.Background())
+	if err != nil {
+		return "", fmt.Errorf("failed to get node info: %w", esErrorString(err))
+	}
+
+	for nodeid, node := range res.Nodes {
+		if id == nodeid {
+			return node.Name, nil
+		}
+	}
+
+	return "", nil
+}
--- a/pkg/es/parallel.go
+++ b/pkg/es/parallel.go
@@ -0,0 +1,166 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"github.com/elastic/go-elasticsearch/v9"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/indices"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cat/tasks"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ccr/stats"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/cluster/health"
+	clusterstats "github.com/elastic/go-elasticsearch/v9/typedapi/cluster/stats"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/core/info"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/explainlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/ilm/getlifecycle"
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types/enums/bytes"
+)
+
+const (
+	ResponseHealth = iota
+	ResponseInfo
+	ResponseCcr
+	ResponseStats
+	ResponseIndices
+	ResponseTasks
+	ResponseExplain
+	ResponseLifecycle
+	ResponseHealthReport
+)
+
+type apiResponse struct {
+	error            error
+	info             *info.Response
+	health           *health.Response
+	healthreport     *HealthReport
+	ccr              *stats.Response
+	stats            *clusterstats.Response
+	indices          *indices.Response
+	indicesbytes     *indices.Response
+	tasks            *tasks.Response
+	lifecycle        *getlifecycle.Response
+	explainlifecycle *explainlifecycle.Response
+	which            int
+}
+
+func getApiData(
+	conf *cfg.Config,
+	es *elasticsearch.TypedClient,
+	wg *sync.WaitGroup,
+	reschan chan apiResponse,
+	which string) {
+	defer wg.Done()
+
+	apiRes := apiResponse{}
+
+	var arerr error
+
+	switch which {
+	case "health":
+		res, err := es.Cluster.Health().
+			Do(context.Background())
+
+		apiRes.health = res
+		apiRes.which = ResponseHealth
+		arerr = err
+
+	case "healthreport":
+		report, err := getHealthReport(conf)
+
+		apiRes.healthreport = report
+		apiRes.which = ResponseHealthReport
+		arerr = err
+
+	case "info":
+		res, err := es.Info().
+			Do(context.Background())
+
+		apiRes.info = res
+		apiRes.which = ResponseInfo
+		arerr = err
+
+	case "ccr":
+		res, err := es.Ccr.Stats().
+			Do(context.Background())
+
+		apiRes.ccr = res
+		apiRes.which = ResponseCcr
+		arerr = err
+
+	case "stats":
+		res, err := es.Cluster.Stats().
+			Do(context.Background())
+
+		apiRes.stats = res
+		apiRes.which = ResponseStats
+		arerr = err
+
+	case "indices":
+		res, err := es.Cat.Indices().
+			Do(context.Background())
+
+		apiRes.indices = &res
+		apiRes.which = ResponseIndices
+		arerr = err
+
+	case "indicesbytes":
+		res, err := es.Cat.
+			Indices().
+			Bytes(bytes.Bytes{Name: "b"}).
+			Do(context.Background())
+
+		apiRes.indicesbytes = &res
+		apiRes.which = ResponseIndices
+		arerr = err
+
+	case "tasks":
+		res, err := es.Cat.Tasks().
+			Do(context.Background())
+
+		apiRes.tasks = &res
+		apiRes.which = ResponseTasks
+		arerr = err
+
+	case "explain":
+		res, err := es.Ilm.
+			ExplainLifecycle("_all").
+			Do(context.Background())
+
+		apiRes.explainlifecycle = res
+		apiRes.which = ResponseExplain
+		arerr = err
+
+	case "policies":
+		res, err := es.Ilm.
+			GetLifecycle().
+			Do(context.Background())
+
+		apiRes.lifecycle = &res
+		apiRes.which = ResponseLifecycle
+		arerr = err
+	}
+
+	if arerr != nil {
+		apiRes.error = fmt.Errorf("failed to get data from API: %w", arerr)
+	}
+
+	reschan <- apiRes
+}
--- a/pkg/es/role.go
+++ b/pkg/es/role.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
-	"strings"

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
@@ -28,13 +27,14 @@ import (
 )

 func RoleNames(conf *cfg.Config) ([]string, error) {
-	res, err := conf.DefaultCluster.ES.Security.GetRole().
+	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get roles: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get roles: %w", esErrorString(err))
 	}

 	roles := make([]string, len(res))
+
 	idx := 0
 	for name := range res {
 		roles[idx] = name
@@ -45,10 +45,10 @@ func RoleNames(conf *cfg.Config) ([]string, error) {
 }

 func RoleList(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Security.GetRole().
+	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get roles: %s", esErrorString(err))
+		return fmt.Errorf("failed to get roles: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "roles", res)
@@ -58,24 +58,25 @@ func RoleList(conf *cfg.Config) error {

 	idx := 0
 	for name, role := range res {
-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			name,
-			fmt.Sprintf("%d", len(role.Cluster)),
-			fmt.Sprintf("%d", len(role.Indices)),
+			role.Cluster,
+			role.Indices,
 		}
 		idx++
 	}

 	table.Sort()
+
 	return table.Print()
 }

 func RoleShow(conf *cfg.Config, rolename string) error {
-	res, err := conf.DefaultCluster.ES.Security.GetRole().
+	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Name(rolename).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get role: %s", esErrorString(err))
+		return fmt.Errorf("failed to get role: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "role", res)
@@ -133,21 +134,22 @@ func roleRemoteClusters(conf *cfg.Config, role types.Role) error {

 	table := printer.NewTable(conf, 2, len(role.RemoteCluster))
 	table.Addheaders("remote cluster", "privilege")
+
 	idx := 0
+
 	for _, priv := range role.RemoteCluster {
 		perms := []string{}
 		for _, perm := range priv.Privileges {
 			perms = append(perms, perm.Name)
 		}

-		table.Entries[idx] = []string{
-			strings.Join(priv.Clusters, ","),
-			strings.Join(perms, ","),
-		}
+		table.Entries[idx] = []any{priv.Clusters, perms}
+
 		idx++
 	}

 	table.Sort()
+
 	return table.Print()
 }

@@ -158,13 +160,15 @@ func roleClusters(conf *cfg.Config, role types.Role) error {

 	table := printer.NewTable(conf, 1, len(role.Cluster))
 	table.Addheaders("cluster rights")
+
 	idx := 0
 	for _, cluster := range role.Cluster {
-		table.Entries[idx] = []string{cluster.Name}
+		table.Entries[idx] = []any{cluster.Name}
 		idx++
 	}

 	table.Sort()
+
 	return table.Print()
 }

@@ -175,23 +179,22 @@ func roleRemoteIndices(conf *cfg.Config, role types.Role) error {

 	table := printer.NewTable(conf, 3, len(role.RemoteIndices))
 	table.Addheaders("remote index names", "index permissions", "allow restricted")
+
 	idx := 0
+
 	for _, priv := range role.RemoteIndices {
 		perms := []string{}
 		for _, perm := range priv.Privileges {
 			perms = append(perms, perm.Name)
 		}

-		table.Entries[idx] = []string{
-			strings.Join(priv.Names, ", "),
-			strings.Join(perms, ", "),
-			fmt.Sprintf("%t", *priv.AllowRestrictedIndices),
-		}
+		table.Entries[idx] = []any{priv.Names, perms, *priv.AllowRestrictedIndices}

 		idx++
 	}

 	table.Sort()
+
 	return table.Print()
 }

@@ -202,23 +205,22 @@ func roleIndices(conf *cfg.Config, role types.Role) error {

 	table := printer.NewTable(conf, 3, len(role.Indices))
 	table.Addheaders("index names", "index permissions", "allow restricted")
+
 	idx := 0
+
 	for _, priv := range role.Indices {
 		perms := []string{}
 		for _, perm := range priv.Privileges {
 			perms = append(perms, perm.Name)
 		}

-		table.Entries[idx] = []string{
-			strings.Join(priv.Names, ", "),
-			strings.Join(perms, ", "),
-			fmt.Sprintf("%t", *priv.AllowRestrictedIndices),
-		}
+		table.Entries[idx] = []any{priv.Names, perms, *priv.AllowRestrictedIndices}

 		idx++
 	}

 	table.Sort()
+
 	return table.Print()
 }

@@ -229,17 +231,19 @@ func roleApplications(conf *cfg.Config, role types.Role) error {

 	table := printer.NewTable(conf, 3, len(role.Applications))
 	table.Addheaders("application", "privileges", "resources")
+
 	idx := 0
 	for _, priv := range role.Applications {
-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			priv.Application,
-			strings.Join(priv.Privileges, ", "),
-			strings.Join(priv.Resources, ", "),
+			priv.Privileges,
+			priv.Resources,
 		}

 		idx++
 	}

 	table.Sort()
+
 	return table.Print()
 }
--- a/pkg/es/role_diff.go
+++ b/pkg/es/role_diff.go
@@ -75,7 +75,7 @@ type Register struct {
 func getCsvRecords(conf *cfg.Config, csvfile string) (map[string]Record, error) {
 	data, err := os.ReadFile(csvfile)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read CSV file: %s", err)
+		return nil, fmt.Errorf("failed to read CSV file: %w", err)
 	}

 	csvreader := csv.NewReader(bytes.NewReader(data))
@@ -85,7 +85,7 @@ func getCsvRecords(conf *cfg.Config, csvfile string) (map[string]Record, error)

 	rows, err := csvreader.ReadAll()
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse CSV: %s", err)
+		return nil, fmt.Errorf("failed to parse CSV: %w", err)
 	}

 	records := make(map[string]Record, len(rows)-1)
@@ -118,7 +118,7 @@ func getCsvRecords(conf *cfg.Config, csvfile string) (map[string]Record, error)
 func getCsvRecord(conf *cfg.Config, csvfile, rolename string) (*Record, error) {
 	fd, err := os.Open(csvfile)
 	if err != nil {
-		return nil, fmt.Errorf("failed to open CSV file: %s", err)
+		return nil, fmt.Errorf("failed to open CSV file: %w", err)
 	}
 	defer func() {
 		if err := fd.Close(); err != nil {
@@ -179,6 +179,7 @@ func diffRoles(conf *cfg.Config, records map[string]Record, res getrole.Response
 	// iterate over records from CSV and register only those which are not deployed
 	for name := range records {
 		reg := Register{name: name, defined: true}
+
 		_, deployed := deployed[name]
 		if !deployed {
 			rows = append(rows, reg)
@@ -207,10 +208,10 @@ func RoleDiff(conf *cfg.Config, csvfile, role string) error {
 		return RoleDiffSingle(conf, csvfile, role)
 	}

-	res, err := conf.DefaultCluster.ES.Security.GetRole().
+	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get roles: %s", esErrorString(err))
+		return fmt.Errorf("failed to get roles: %w", esErrorString(err))
 	}

 	rows := diffRoles(conf, records, res)
@@ -229,7 +230,7 @@ func RoleDiff(conf *cfg.Config, csvfile, role string) error {
 			defined = printer.Colorize(conf, "red", "undefined")
 		}

-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			row.name,
 			deployed,
 			defined,
@@ -242,13 +243,14 @@ func RoleDiff(conf *cfg.Config, csvfile, role string) error {
 }

 func getRoleMappingGroups(conf *cfg.Config, rolename string) ([]string, error) {
-	mappings, err := conf.DefaultCluster.ES.Security.GetRoleMapping().
+	mappings, err := conf.DefaultCluster.ES().Security.GetRoleMapping().
 		Do(context.Background())
 	if err != nil {
-		return nil, fmt.Errorf("failed to get role mappings: %s", esErrorString(err))
+		return nil, fmt.Errorf("failed to get role mappings: %w", esErrorString(err))
 	}

 	groups := []string{}
+
 	for _, mapping := range mappings {
 		if slices.Contains(mapping.Roles, rolename) {
 			for _, rule := range mapping.Rules.Any {
@@ -262,24 +264,24 @@ func getRoleMappingGroups(conf *cfg.Config, rolename string) ([]string, error) {
 	return groups, nil
 }

-func compareSlices(name string, a, b []string) {
-	slices.Sort(a)
-	slices.Sort(b)
+func compareSlices(name string, left, right []string) {
+	slices.Sort(left)
+	slices.Sort(right)

-	if slices.Compare(a, b) != 0 {
+	if slices.Compare(left, right) != 0 {
 		fmt.Printf("%s differs:\ndeployed: %s\n     csv: %s\n",
-			name, strings.Join(a, ","), strings.Join(b, ","))
+			name, strings.Join(left, ","), strings.Join(right, ","))
 	} else {
 		fmt.Printf("deployed %s matches csv definition\n", name)
 	}
 }

 func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
-	res, err := conf.DefaultCluster.ES.Security.GetRole().
+	res, err := conf.DefaultCluster.ES().Security.GetRole().
 		Name(rolename).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get role: %s", esErrorString(err))
+		return fmt.Errorf("failed to get role: %w", esErrorString(err))
 	}

 	record, err := getCsvRecord(conf, csvfile, rolename)
@@ -289,16 +291,19 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {

 	if !record.defined {
 		fmt.Printf("role %s is not defined\n", rolename)
+
 		return nil
 	}

 	role, exists := res[rolename]
 	if !exists {
 		fmt.Printf("role %s is not deployed\n", rolename)
+
 		return nil
 	} else {
 		fmt.Printf("role %s is deployed\n", rolename)
 	}
+
 	slog.Debug("found role", "role", role)

 	if conf.Debug {
@@ -310,6 +315,7 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
 	if err != nil {
 		return err
 	}
+
 	slog.Debug("group mappings", "groups", groups)

 	// check cluster setting
@@ -321,6 +327,7 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {
 	// check index names+privs
 	indices := []string{}
 	privs := []string{}
+
 	for _, index := range role.Indices {
 		for _, name := range index.Names {
 			indices = append(indices, strings.ReplaceAll(name, "**", "*"))
@@ -333,6 +340,7 @@ func RoleDiffSingle(conf *cfg.Config, csvfile, rolename string) error {

 	// check kibana application space
 	spaces := []string{}
+
 	for _, app := range role.Applications {
 		for _, resource := range app.Resources {
 			if strings.Contains(resource, "space:") {
--- a/pkg/es/rollover.go
+++ b/pkg/es/rollover.go
@@ -31,14 +31,17 @@ func RolloverConditions(conf *cfg.Config) types.RolloverConditionsVariant {
 	if conf.MaxAge != "" {
 		cond.MaxAge(esdsl.NewDuration().String(conf.MaxAge))
 	}
+
 	if conf.MaxDocs > 0 {
 		cond.MaxDocs(int64(conf.MaxDocs))
 	}
+
 	if conf.MaxShardSize > 0 {
 		bs := esdsl.NewByteSize()
 		bs.Int64(int64(conf.MaxShardSize))
 		cond.MaxPrimaryShardSize(bs)
 	}
+
 	if conf.MaxShardDocs > 0 {
 		cond.MaxPrimaryShardDocs(int64(conf.MaxShardDocs))
 	}
@@ -47,7 +50,7 @@ func RolloverConditions(conf *cfg.Config) types.RolloverConditionsVariant {
 }

 func RolloverAlias(conf *cfg.Config, alias string) (*rollover.Response, error) {
-	roll := conf.DefaultCluster.ES.Indices.Rollover(alias)
+	roll := conf.DefaultCluster.ES().Indices.Rollover(alias)

 	if conf.Wait {
 		roll.WaitForActiveShards("all")
--- a/pkg/es/search.go
+++ b/pkg/es/search.go
@@ -26,7 +26,6 @@ import (

 	"codeberg.org/scip/esctl/pkg/cfg"
 	"codeberg.org/scip/esctl/pkg/printer"
-	"github.com/alecthomas/repr"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/core/search"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/esdsl"
 	"github.com/elastic/go-elasticsearch/v9/typedapi/indices/validatequery"
@@ -50,7 +49,7 @@ func Search(conf *cfg.Config, queries []string) error {
 		return validateSearch(conf, queries)
 	}

-	searchEs := conf.DefaultCluster.ES.Search().Index(conf.Index)
+	searchEs := conf.DefaultCluster.ES().Search().Index(conf.Index)

 	queryCaster, err := prepareQuery(conf, queries)
 	if err != nil {
@@ -83,13 +82,13 @@ func explainSearch(conf *cfg.Config, search *search.Search) error {
 		Size(1). // one's enough for explain
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to call explain search (esdsl): %s", esErrorString(err))
+		return fmt.Errorf("failed to call explain search (esdsl): %w", esErrorString(err))
 	}

 	if conf.Debug {
 		raw, err := json.Marshal(res)
 		if err != nil {
-			return fmt.Errorf("failed to marshal explain result: %s", err)
+			return fmt.Errorf("failed to marshal explain result: %w", err)
 		}

 		value := gjson.Get(string(raw), "hits.hits.0._explanation")
@@ -112,6 +111,7 @@ func explainSearch(conf *cfg.Config, search *search.Search) error {

 func explain(res *types.ExplanationDetail, indent string) {
 	fmt.Println(indent + "- " + res.Description)
+
 	for _, ex := range res.Details {
 		fmt.Println(indent + "  - " + ex.Description)
 		fmt.Println(indent + fmt.Sprintf("    score: %f", res.Value))
@@ -121,7 +121,7 @@ func explain(res *types.ExplanationDetail, indent string) {
 }

 func validateSearch(conf *cfg.Config, queries []string) error {
-	validate := conf.DefaultCluster.ES.Indices.ValidateQuery()
+	validate := conf.DefaultCluster.ES().Indices.ValidateQuery()

 	queryCaster, err := prepareQuery(conf, queries)
 	if err != nil {
@@ -135,7 +135,7 @@ func validateSearch(conf *cfg.Config, queries []string) error {
 	res, err := validate.
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to validate search (esdsl): %s", esErrorString(err))
+		return fmt.Errorf("failed to validate search (esdsl): %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "search", res)
@@ -149,32 +149,13 @@ func validateSearch(conf *cfg.Config, queries []string) error {
 	return nil
 }

-func Debug(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Search().
-		Index(conf.Index).
-		Size(0).
-		Aggregations(map[string]types.Aggregations{
-			"min_ts": *esdsl.NewMinAggregation().Field("@timestamp").AggregationsCaster(),
-			"max_ts": *esdsl.NewMaxAggregation().Field("@timestamp").AggregationsCaster(),
-		}).
-		Do(context.Background())
-
-	if err != nil {
-		return err
-	}
-
-	repr.Println(res)
-
-	return nil
-}
-
 func searchOnce(conf *cfg.Config, search *search.Search) error {
 	res, err := search.
 		From(conf.From).
 		Size(conf.To).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to run search (esdsl): %s", esErrorString(err))
+		return fmt.Errorf("failed to run search (esdsl): %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "search", res)
@@ -187,18 +168,19 @@ func searchOnce(conf *cfg.Config, search *search.Search) error {
 // https://www.elastic.co/docs/reference/elasticsearch/clients/go/using-the-api/searching#_pit_search_after
 func searchPit(conf *cfg.Config, req *search.Request) error {
 	ctx := context.Background()
-	pit, err := conf.DefaultCluster.ES.OpenPointInTime(conf.Index).KeepAlive("1m").Do(ctx)
+
+	pit, err := conf.DefaultCluster.ES().OpenPointInTime(conf.Index).KeepAlive("1m").Do(ctx)
 	if err != nil {
-		return fmt.Errorf("failed to open point-in-time request for search: %s", err)
+		return fmt.Errorf("failed to open point-in-time request for search: %w", err)
 	}
 	defer func() {
-		_, err := conf.DefaultCluster.ES.ClosePointInTime().Id(pit.Id).Do(ctx)
+		_, err := conf.DefaultCluster.ES().ClosePointInTime().Id(pit.Id).Do(ctx)
 		if err != nil {
 			log.Fatalf("failed to close PIT: %s", err)
 		}
 	}()

-	search := conf.DefaultCluster.ES.Search().
+	search := conf.DefaultCluster.ES().Search().
 		Request(req).
 		Pit(esdsl.NewPointInTimeReference().
 			Id(pit.Id).
@@ -212,7 +194,7 @@ func searchPit(conf *cfg.Config, req *search.Request) error {
 	for {
 		res, err := search.Do(ctx)
 		if err != nil {
-			return fmt.Errorf("failed to run search (esdsl pit): %s", esErrorString(err))
+			return fmt.Errorf("failed to run search (esdsl pit): %w", esErrorString(err))
 		}

 		if len(res.Hits.Hits) == 0 {
@@ -242,7 +224,7 @@ func searchTail(conf *cfg.Config, search *search.Search) error {
 	for {
 		res, err := search.Do(context.Background())
 		if err != nil {
-			return fmt.Errorf("failed to run search (esdsl): %s", esErrorString(err))
+			return fmt.Errorf("failed to run search (esdsl): %w", esErrorString(err))
 		}

 		slog.Debug("ES result", "search", res)
--- a/pkg/es/search_filter.go
+++ b/pkg/es/search_filter.go
@@ -46,7 +46,7 @@ type filter struct {
 }

 // Build a new  filter object. We use this to  build our elastic query
-// out of it. We support differnt types of queries:
+// out of it. We support different types of queries:
 //
 //   - nop filter: no query at all, just return the first N documents.
 //
@@ -63,6 +63,7 @@ type filter struct {
 // must match literally, and range filters using -r "@timestamp:2026-05-28T10:00:00 to now"
 func NewFilter(query string) (*filter, error) {
 	var separator string
+
 	var criteria int // we use the constants on top for this

 	switch {
@@ -76,7 +77,7 @@ func NewFilter(query string) (*filter, error) {

 	part := strings.Split(query, separator)
 	if len(part) != 2 {
-		return nil, fmt.Errorf("search queries must be in the form field<sep>pattern where <sep> must be one of: = or !=")
+		return nil, errors.New("search queries must be in the form field<sep>pattern where <sep> must be one of: = or !=")
 	}

 	flt := &filter{term: part[0], filter: part[1], criteria: criteria}
@@ -234,7 +235,6 @@ func addFilters(conf *cfg.Config) ([]types.QueryVariant, error) {
 		}

 		filters[count-1] = rng
-
 	}

 	return filters, nil
@@ -243,11 +243,10 @@ func addFilters(conf *cfg.Config) ([]types.QueryVariant, error) {
 // check if the conf.SortBy  field (default: @timestamp) is searchable
 // by using the field capabilities API.
 func addSort(conf *cfg.Config, search *search.Search) *search.Search {
-	res, err := conf.DefaultCluster.ES.FieldCaps().
+	res, err := conf.DefaultCluster.ES().FieldCaps().
 		Index(conf.Index).
 		Fields(conf.SortBy).
 		Do(context.Background())
-
 	if err != nil {
 		// whatever it was, do not add Sort()
 		slog.Debug("get field capabilities", "field", conf.SortBy, "error", esErrorString(err))
--- a/pkg/es/searchql.go
+++ b/pkg/es/searchql.go
@@ -0,0 +1,79 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package es
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+
+	"codeberg.org/scip/esctl/pkg/cfg"
+	"codeberg.org/scip/esctl/pkg/printer"
+)
+
+type searchQlColumn struct {
+	Name string `json:"name"`
+	Type string `json:"type"`
+}
+
+type searchQlResult struct {
+	Partial bool             `json:"is_partial"`
+	Docs    int              `json:"documents_found"`
+	Columns []searchQlColumn `json:"columns"`
+	Values  [][]any          `json:"values"`
+}
+
+func SearchQL(conf *cfg.Config, querystring string) error {
+	query := conf.DefaultCluster.ES().Esql.Query().
+		Query(querystring).
+		DropNullColumns(true)
+
+	res, err := query.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to run esql query: %w", esErrorString(err))
+	}
+
+	if conf.Debug {
+		fmt.Println(string(res))
+	}
+
+	qlResult := searchQlResult{}
+
+	if err = json.Unmarshal(res, &qlResult); err != nil {
+		return fmt.Errorf("failed to unmarshal esql result: %w", err)
+	}
+
+	slog.Debug("searchql result", "qlres", qlResult)
+
+	if qlResult.Docs == 0 {
+		return nil
+	}
+
+	table := printer.NewTable(conf, len(qlResult.Columns), len(qlResult.Values))
+
+	headers := make([]string, len(qlResult.Columns))
+	for idx, col := range qlResult.Columns {
+		headers[idx] = col.Name
+	}
+
+	table.Addheaders(headers...)
+
+	table.Entries = qlResult.Values
+
+	return table.Print()
+}
--- a/pkg/es/shard.go
+++ b/pkg/es/shard.go
@@ -40,8 +40,7 @@ func colorzizeShard(conf *cfg.Config, state, name string) string {
 }

 func resolvePrirep(state string) string {
-	switch state {
-	case "p":
+	if state == "p" {
 		return "primary"
 	}

@@ -83,12 +82,10 @@ func filterShards(conf *cfg.Config, shardlist shards.Response) shards.Response {
 }

 func ShardList(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Cat.Shards().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Cat.Shards().
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get shards: %s", esErrorString(err))
+		return fmt.Errorf("failed to get shards: %w", esErrorString(err))
 	}

 	shardlist := filterShards(conf, res)
@@ -109,7 +106,7 @@ func printShards(conf *cfg.Config, shardlist shards.Response) error {
 	for idx, shard := range shardlist {
 		name := colorzizeShard(conf, *shard.State, *shard.Index)

-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			name,
 			*shard.Shard,
 			resolvePrirep(*shard.Prirep),
@@ -127,6 +124,7 @@ func printShards(conf *cfg.Config, shardlist shards.Response) error {
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -135,12 +133,10 @@ func printShards(conf *cfg.Config, shardlist shards.Response) error {
 }

 func ShardShow(conf *cfg.Config, index string) error {
-	res, err := conf.DefaultCluster.ES.Cat.Shards().Index(index).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Cat.Shards().Index(index).
 		Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get shards: %s", esErrorString(err))
+		return fmt.Errorf("failed to get shards: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "shards", res)
@@ -149,3 +145,70 @@ func ShardShow(conf *cfg.Config, index string) error {

 	return printShards(conf, res)
 }
+
+func ShardAllocation(conf *cfg.Config, index string) error {
+	explain := conf.DefaultCluster.ES().Cluster.AllocationExplain().
+		Index(index).
+		Primary(conf.Primary).
+		Shard(conf.Shards)
+
+	if conf.FromNode != "" {
+		explain.CurrentNode(conf.FromNode)
+	}
+
+	res, err := explain.Do(context.Background())
+	if err != nil {
+		return fmt.Errorf("failed to get shard allocation explain: %w", esErrorString(err))
+	}
+
+	slog.Debug("ES result", "explain", res)
+
+	table := printer.NewTable(conf, 2, 10)
+	table.Addheaders("shard allocation setting", "value")
+
+	table.Entries = [][]any{
+		{"Index", index},
+		{"Current state", res.CurrentState},
+		{"Can rebalance cluster", res.CanRebalanceCluster.Name},
+		{"Can rebalance to another node", res.CanRebalanceToOtherNode.Name},
+		{"Can remain on current node", res.CanRemainOnCurrentNode.Name},
+	}
+
+	if res.CurrentNode != nil {
+		currentNode := res.CurrentNode
+		roles := make([]string, len(currentNode.Roles))
+
+		for idx, role := range currentNode.Roles {
+			roles[idx] = role.Name
+		}
+
+		table.Entries = append(table.Entries, [][]any{
+			{"Current node", currentNode.Name},
+			{"Current k8s node", currentNode.Attributes["k8s_node_name"]},
+			{"Current node address", currentNode.TransportAddress},
+			{"Current node id", currentNode.Id},
+			{"Current node weight", currentNode.WeightRanking},
+			{"Current node roles", roles},
+		}...)
+	} else {
+		table.AddRow("Current node", "not currently assigned to any node")
+	}
+
+	if res.CurrentState == "unassigned" {
+		table.AddRow("Unassignment reason", res.UnassignedInfo.Reason.String()+" at "+res.UnassignedInfo.At.(string))
+	}
+
+	for _, nodeDecision := range res.NodeAllocationDecisions {
+		for _, decider := range nodeDecision.Deciders {
+			table.AddRow("Allocation decider", decider.Decider)
+			table.AddRow("    -> decision", decider.Decision.String())
+			table.AddRow("    -> explanation", decider.Explanation)
+		}
+	}
+
+	if err := table.Print(); err != nil {
+		return err
+	}
+
+	return nil
+}
--- a/pkg/es/snapshot.go
+++ b/pkg/es/snapshot.go
@@ -43,9 +43,9 @@ type Snapshot struct {

 func SnapshotList(conf *cfg.Config) error {
 	// get partial indicies
-	ires, err := conf.DefaultCluster.ES.Cat.Indices().Do(context.Background())
+	ires, err := conf.DefaultCluster.ES().Cat.Indices().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get indicies: %s", esErrorString(err))
+		return fmt.Errorf("failed to get indicies: %w", esErrorString(err))
 	}

 	indicies := map[string]int{}
@@ -56,9 +56,9 @@ func SnapshotList(conf *cfg.Config) error {
 	}

 	// get snapshots
-	sres, err := conf.DefaultCluster.ES.Cat.Snapshots().Do(context.Background())
+	sres, err := conf.DefaultCluster.ES().Cat.Snapshots().Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get snapshots: %s", esErrorString(err))
+		return fmt.Errorf("failed to get snapshots: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "indicies", sres)
@@ -88,7 +88,7 @@ func SnapshotList(conf *cfg.Config) error {
 	table.Addheaders("name", "index", "start", "orphaned", "status")

 	for idx, snap := range snapshots {
-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			snap.Name,
 			snap.Forindex,
 			snap.Start,
@@ -98,6 +98,7 @@ func SnapshotList(conf *cfg.Config) error {
 	}

 	table.Sort()
+
 	if err := table.Print(); err != nil {
 		return err
 	}
@@ -106,9 +107,9 @@ func SnapshotList(conf *cfg.Config) error {
 }

 func SnapshotShow(conf *cfg.Config, snapshot string) error {
-	res, err := conf.DefaultCluster.ES.Snapshot.Get("*", snapshot).Do(context.Background())
+	res, err := conf.DefaultCluster.ES().Snapshot.Get("*", snapshot).Do(context.Background())
 	if err != nil {
-		return fmt.Errorf("failed to get snapshot: %s", esErrorString(err))
+		return fmt.Errorf("failed to get snapshot: %w", esErrorString(err))
 	}

 	slog.Debug("ES result", "snapshot", res)
@@ -122,20 +123,20 @@ func SnapshotShow(conf *cfg.Config, snapshot string) error {

 	snap := res.Snapshots[0]

-	table.Entries = [][]string{
+	table.Entries = [][]any{
 		{"snapshot", snapshot},
 		{"uuid", snap.Uuid},
 		{"repository", *snap.Repository},
-		{"version_id", fmt.Sprintf("%d", snap.VersionId)},
+		{"version_id", snap.VersionId},
 		{"version", *snap.Version},
-		{"include_global_state", fmt.Sprintf("%t", *snap.IncludeGlobalState)},
+		{"include_global_state", *snap.IncludeGlobalState},
 		{"state", *snap.State},
-		{"start_time", fmt.Sprintf("%s", snap.StartTime)},
-		{"end_time", fmt.Sprintf("%s", snap.EndTime)},
-		{"duration_in_millis", fmt.Sprintf("%d", *snap.DurationInMillis)},
-		{"shards-total", fmt.Sprintf("%d", snap.Shards.Total)},
-		{"shards-failed", fmt.Sprintf("%d", snap.Shards.Failed)},
-		{"shards-successful", fmt.Sprintf("%d", snap.Shards.Successful)},
+		{"start_time", snap.StartTime},
+		{"end_time", snap.EndTime},
+		{"duration_in_millis", *snap.DurationInMillis},
+		{"shards-total", snap.Shards.Total},
+		{"shards-failed", snap.Shards.Failed},
+		{"shards-successful", snap.Shards.Successful},
 	}

 	if err := table.Print(); err != nil {
--- a/pkg/es/task.go
+++ b/pkg/es/task.go
@@ -28,19 +28,17 @@ import (
 )

 func TaskList(conf *cfg.Config) error {
-	res, err := conf.DefaultCluster.ES.Cat.Tasks().
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
+	res, err := conf.DefaultCluster.ES().Cat.Tasks().
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to get index templates: %s", esErrorString(err))
+		return fmt.Errorf("failed to get index templates: %w", esErrorString(err))
 	}

 	slog.Debug("res", "tasks", res)

 	table := printer.NewTable(conf, 8, len(res))
 	table.Addheaders("task id", "action", "start time", "run time", "node", "type")
+
 	for idx, task := range res {
 		var ts time.Time

@@ -51,10 +49,10 @@ func TaskList(conf *cfg.Config) error {
 			ts = time.Unix(int64(epc/1000), 0)
 		}

-		table.Entries[idx] = []string{
+		table.Entries[idx] = []any{
 			*task.TaskId,
 			*task.Action,
-			ts.Format("2006-01-02T15:04:05"),
+			ts,
 			*task.RunningTime,
 			*task.Node,
 			*task.Type,
@@ -65,14 +63,11 @@ func TaskList(conf *cfg.Config) error {
 }

 func TaskCancel(conf *cfg.Config, taskid string) error {
-	_, err := conf.DefaultCluster.ES.Tasks.Cancel().
+	_, err := conf.DefaultCluster.ES().Tasks.Cancel().
 		TaskId(taskid).
-		Header("content-type", "application/json").
-		Header("accept", "application/json").
 		Do(context.Background())
-
 	if err != nil {
-		return fmt.Errorf("failed to cancel task: %s", esErrorString(err))
+		return fmt.Errorf("failed to cancel task: %w", esErrorString(err))
 	}

 	return nil
--- a/pkg/printer/bytes.go
+++ b/pkg/printer/bytes.go
@@ -0,0 +1,37 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package printer
+
+import "github.com/dustin/go-humanize"
+
+type ByteSize struct {
+	size uint64
+}
+
+func (b *ByteSize) String() string {
+	return humanize.Bytes(b.size)
+}
+
+func Bytes(size int64) *ByteSize {
+	return &ByteSize{size: uint64(size)}
+}
+
+func ByteString(size int64) string {
+	b := ByteSize{size: uint64(size)}
+
+	return b.String()
+}
--- a/pkg/printer/cast.go
+++ b/pkg/printer/cast.go
@@ -0,0 +1,105 @@
+/*
+Copyright © 2026 Thomas von Dein
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+package printer
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/elastic/go-elasticsearch/v9/typedapi/types"
+)
+
+func any2string(in any) string {
+	//nolint:gocritic
+	switch val := in.(type) {
+	case string:
+		return val
+	case bool:
+		return strconv.FormatBool(val)
+	case int64:
+		return strconv.FormatInt(val, 10)
+	case int:
+		return strconv.Itoa(val)
+	case float64:
+		return fmt.Sprintf("%.2f", val)
+	case float32:
+		return fmt.Sprintf("%.2f", val)
+	case []string:
+		return strings.Join(val, ",")
+	case ByteSize:
+		return val.String()
+	case *ByteSize:
+		return val.String()
+	case time.Time:
+		return val.Format("2006-01-02 15:04:05")
+	case time.Duration:
+		return val.String()
+	case []byte:
+		return string(val)
+	case nil:
+		return "null"
+	case types.Percentage, types.DateTime:
+		return val.(string)
+	}
+
+	return ""
+}
+
+func (data *Table) preprocessRows() {
+	if data.processed {
+		// only do it once
+		return
+	}
+
+	// convert entries to strings
+	data.rows = make([][]string, len(data.Entries))
+	for rowidx, entries := range data.Entries {
+		data.rows[rowidx] = make([]string, len(entries))
+
+		for colidx, entry := range data.Entries[rowidx] {
+			data.rows[rowidx][colidx] = any2string(entry)
+		}
+	}
+
+	// determine header lenght's
+	for idx, head := range data.Headers {
+		data.lenHeaders[idx] = visibleLen(head)
+	}
+
+	// determine max width per column
+	for _, entries := range data.rows {
+		currentWidth := 0
+
+		for idx, entry := range entries {
+			length := visibleLen(entry)
+
+			if data.lenHeaders[idx] < length {
+				if length > currentWidth+data.maxwidth {
+					data.lenHeaders[idx] = data.maxwidth - currentWidth
+				} else {
+					data.lenHeaders[idx] = length
+				}
+			}
+
+			currentWidth += data.lenHeaders[idx]
+		}
+	}
+
+	data.processed = true
+}
--- a/pkg/printer/doc.go
+++ b/pkg/printer/doc.go
@@ -33,7 +33,6 @@ func PrintDocs(conf *cfg.Config, hits []types.Hit) {
 	for _, hit := range hits {
 		PrintDoc(conf, hit)
 	}
-
 }

 func PrintDoc(conf *cfg.Config, hit types.Hit) {
@@ -52,6 +51,6 @@ func PrintDoc(conf *cfg.Config, hit types.Hit) {
 		value := gjson.Get(docjson, conf.Path)
 		fmt.Println(value.String())
 	} else {
-		fmt.Print(docjson)
+		fmt.Println(docjson)
 	}
 }
--- a/pkg/printer/pager.go
+++ b/pkg/printer/pager.go
@@ -34,12 +34,14 @@ var (
 	titleStyle = func() lipgloss.Style {
 		b := lipgloss.RoundedBorder()
 		b.Right = "├"
+
 		return lipgloss.NewStyle().BorderStyle(b).Padding(0, 1)
 	}()

 	infoStyle = func() lipgloss.Style {
 		b := lipgloss.RoundedBorder()
 		b.Left = "┤"
+
 		return titleStyle.BorderStyle(b)
 	}()
 )
@@ -56,10 +58,9 @@ func (m model) Init() tea.Cmd {
 }

 func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
-	var (
-		cmd  tea.Cmd
-		cmds []tea.Cmd
-	)
+	var cmd tea.Cmd
+
+	cmds := make([]tea.Cmd, 1)

 	switch msg := msg.(type) {
 	case tea.KeyMsg:
@@ -90,7 +91,7 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {

 	// Handle keyboard and mouse events in the viewport
 	m.viewport, cmd = m.viewport.Update(msg)
-	cmds = append(cmds, cmd)
+	cmds[0] = cmd

 	return m, tea.Batch(cmds...)
 }
@@ -99,6 +100,7 @@ func (m model) View() string {
 	if !m.ready {
 		return "\n  Initializing..."
 	}
+
 	return fmt.Sprintf("%s\n%s\n%s", m.headerView(), m.viewport.View(), m.footerView())
 }

@@ -106,30 +108,25 @@ func (m model) headerView() string {
 	// title := titleStyle.Render("RPN Help Overview")
 	title := titleStyle.Render(m.title)
 	line := strings.Repeat("─", max(0, m.viewport.Width-lipgloss.Width(title)))
+
 	return lipgloss.JoinHorizontal(lipgloss.Center, title, line)
 }

 func (m model) footerView() string {
 	info := infoStyle.Render(fmt.Sprintf("%3.f%%", m.viewport.ScrollPercent()*100))
 	line := strings.Repeat("─", max(0, m.viewport.Width-lipgloss.Width(info)))
+
 	return lipgloss.JoinHorizontal(lipgloss.Center, line, info)
 }

-func max(a, b int) int {
-	if a > b {
-		return a
-	}
-	return b
-}
-
 func Pager(title, message string) {
-	p := tea.NewProgram(
+	pager := tea.NewProgram(
 		model{content: message, title: title},
 		tea.WithAltScreen(),       // use the full size of the terminal in its "alternate screen buffer"
 		tea.WithMouseCellMotion(), // turn on mouse support so we can track the mouse wheel
 	)

-	if _, err := p.Run(); err != nil {
+	if _, err := pager.Run(); err != nil {
 		fmt.Println("could not run pager:", err)
 		os.Exit(1)
 	}
--- a/pkg/printer/table.go
+++ b/pkg/printer/table.go
@@ -25,40 +25,65 @@ import (
 	"strings"

 	"codeberg.org/scip/esctl/pkg/cfg"
-	"github.com/olekukonko/tablewriter"
-	"github.com/olekukonko/tablewriter/renderer"
-	"github.com/olekukonko/tablewriter/tw"
+	"github.com/seeruk/go-wordwrap"
 	"gopkg.in/yaml.v3"
 )

 type Table struct {
-	Mode    string // table, markdown, json
-	Headers []string
-	Entries [][]string
+	Mode       string // tsv, json, yaml
+	Headers    []string
+	RawHeaders []string
+	Entries    [][]any

+	rows       [][]string // representation used for printing
+	processed  bool
 	lenHeaders []int
+	alignInts  bool
+	maxwidth   int
 }

 func NewTable(conf *cfg.Config, columns, rows int) *Table {
-	table := Table{Mode: conf.Output}
+	table := Table{Mode: conf.Output, maxwidth: cfg.GetTermWidth()}

 	table.Headers = make([]string, columns)
-	table.Entries = make([][]string, rows)
+	table.RawHeaders = make([]string, columns)
+	table.Entries = make([][]any, rows)
 	table.lenHeaders = make([]int, columns)
+	table.alignInts = conf.AlignInts

 	return &table
 }

-func (data *Table) Print() error {
-	switch data.Mode {
-	case "markdown", "md":
-		return data.PrintMarkdown()
+func NewTableEmpty(conf *cfg.Config) *Table {
+	table := Table{Mode: conf.Output, maxwidth: cfg.GetTermWidth()}
+	table.alignInts = conf.AlignInts
+
+	return &table
+}
+
+func (table *Table) WithHeaders(headers ...string) *Table {
+	count := len(headers)
+
+	table.Entries = [][]any{}
+	table.lenHeaders = make([]int, count)
+	table.Headers = make([]string, count)
+	table.RawHeaders = make([]string, count)
+
+	table.Addheaders(headers...)
+
+	return table
+}
+
+func (table *Table) Print() error {
+	switch table.Mode {
 	case "json":
-		return data.PrintJSON()
+		return table.PrintJSON()
 	case "yaml":
-		return data.PrintYAML()
+		return table.PrintYAML()
+	case "csv":
+		return table.PrintCSV()
 	default:
-		return data.PrintTSV()
+		return table.PrintTSV()
 	}
 }

@@ -66,26 +91,12 @@ var (
 	ansiCtrlSeq = regexp.MustCompile(`\033.[0-9;]+m`)
 )

-// needed for json and yaml output
-func (data *Table) toMap() []map[string]string {
-	raw := make([]map[string]string, len(data.Entries))
-
-	for idx, entries := range data.Entries {
-		raw[idx] = make(map[string]string, len(data.Headers))
-		for eidx, entry := range entries {
-			raw[idx][data.Headers[eidx]] = entry
-		}
-	}
-
-	return raw
-}
-
-func (data *Table) PrintYAML() error {
-	raw := data.toMap()
+func (table *Table) PrintYAML() error {
+	raw := table.toMap()

 	body, err := yaml.Marshal(raw)
 	if err != nil {
-		return fmt.Errorf("failed to produce YAML output: %s", err)
+		return fmt.Errorf("failed to produce YAML output: %w", err)
 	}

 	fmt.Println(string(body))
@@ -93,12 +104,12 @@ func (data *Table) PrintYAML() error {
 	return nil
 }

-func (data *Table) PrintJSON() error {
-	raw := data.toMap()
+func (table *Table) PrintJSON() error {
+	raw := table.toMap()

 	body, err := json.MarshalIndent(raw, "", "  ")
 	if err != nil {
-		return fmt.Errorf("failed to produce JSON output: %s", err)
+		return fmt.Errorf("failed to produce JSON output: %w", err)
 	}

 	fmt.Println(string(body))
@@ -106,194 +117,152 @@ func (data *Table) PrintJSON() error {
 	return nil
 }

-// Well.  tablewriter  should be  able to  print in  TSV mode,  but it
-// doesn't  work because  of  the various  ansic  color escapes  we're
-// using. Therefore we do it the hard way and use our own TSV printer.
-func (data *Table) PrintTSV() error {
-	// determine lenght's
-	for idx, head := range data.Headers {
-		data.lenHeaders[idx] = visibleLen(head)
-	}
+func (table *Table) PrintTSV() error {
+	// length's, convert cell types
+	table.preprocessRows()

-	for _, entries := range data.Entries {
-		for idx, entry := range entries {
-			length := visibleLen(entry)
-			if data.lenHeaders[idx] < length {
-				data.lenHeaders[idx] = length
-			}
+	// output headers
+	for idx, header := range table.Headers {
+		if idx+1 != len(table.Headers) {
+			fmt.Print(header, strings.Repeat(" ", table.lenHeaders[idx]-visibleLen(header)))
+		} else {
+			// no padding for last header
+			fmt.Print(header)
 		}
-	}

-	// output
-	for idx, header := range data.Headers {
-		fmt.Print(header, strings.Repeat(" ", data.lenHeaders[idx]-visibleLen(header)))
-		if idx < len(data.Headers)-1 {
+		if idx < len(table.Headers)-1 {
 			fmt.Print("  ")
 		}
 	}
+
 	fmt.Println()

-	for _, entries := range data.Entries {
+	for _, entries := range table.rows {
+		currentWidth := 0
+
 		for idx, entry := range entries {
 			length := visibleLen(entry)

-			if isInt(entry) {
-				// align right
-				fmt.Print(strings.Repeat(" ", data.lenHeaders[idx]-length), entry)
-			} else {
-				fmt.Print(entry, strings.Repeat(" ", data.lenHeaders[idx]-length))
+			if length+currentWidth > table.maxwidth && table.maxwidth-currentWidth > 1 {
+				// text is too wide to be put into one line, wrap it
+				wrapper := wordwrap.Wrapper(table.maxwidth-currentWidth, false)
+				wrapped := wrapper(entry)
+
+				// and indent it
+				for idx, line := range strings.Split(wrapped, "\n") {
+					if idx == 0 {
+						entry = line
+					} else {
+						entry += "\n  " + strings.Repeat(" ", currentWidth) + line
+					}
+				}
 			}

-			if idx < len(data.Headers)-1 {
+			currentWidth += table.lenHeaders[idx]
+
+			switch {
+			case isInt(entry) && table.alignInts:
+				// align right
+				fmt.Print(strings.Repeat(" ", table.lenHeaders[idx]-length), entry)
+			case length < table.lenHeaders[idx] && idx+1 != len(entries):
+				// pad right, if required
+				fmt.Print(entry, strings.Repeat(" ", table.lenHeaders[idx]-length))
+			default:
+				// no padding for last entry
+				fmt.Print(entry)
+			}
+
+			if idx < len(table.Headers)-1 {
 				fmt.Print("  ")
 			}
 		}
+
 		fmt.Println()
 	}

 	return nil
 }

-func (data *Table) PrintTabularFail() error {
-	OFS := "  "
+func (table *Table) PrintCSV() error {
+	table.preprocessRows()

-	tableString := &strings.Builder{}
+	fmt.Println(strings.Join(table.RawHeaders, ","))

-	styleTSV := tw.NewSymbolCustom("space").WithColumn("\t")
+	for _, entries := range table.rows {
+		row := make([]string, len(entries))

-	table := tablewriter.NewTable(tableString,
-		tablewriter.WithRenderer(
-			renderer.NewBlueprint(tw.Rendition{
-				Borders: tw.BorderNone,
-				Symbols: styleTSV,
-				Settings: tw.Settings{
-					Separators: tw.SeparatorsNone,
-					Lines:      tw.LinesNone,
-				},
-			})),
-		tablewriter.WithConfig(tablewriter.Config{
-			Header: tw.CellConfig{
-				Formatting: tw.CellFormatting{
-					AutoFormat: tw.Off,
-				},
-				Padding: tw.CellPadding{Global: tw.Padding{Left: "", Right: OFS}},
-			},
-			Row: tw.CellConfig{
-				Formatting: tw.CellFormatting{
-					AutoWrap:  tw.WrapNone,
-					Alignment: tw.AlignLeft,
-				},
-				Padding: tw.CellPadding{Global: tw.Padding{Right: OFS}},
-			},
+		for idx, entry := range entries {
+			if strings.Contains(entry, " ") || strings.Contains(entry, ",") {
+				row[idx] = `"` + entry + `"`
+			} else {
+				row[idx] = entry
+			}
+		}

-			Debug: true,
-		}),
-	)
-
-	table.Header(data.Headers)
-
-	if err := table.Bulk(data.Entries); err != nil {
-		return fmt.Errorf("failed to add data to table renderer: %s", err)
+		fmt.Println(strings.Join(row, ","))
 	}

-	if err := table.Render(); err != nil {
-		return fmt.Errorf("failed to render table: %s", err)
-	}
-
-	// we  need to trim  our output here, because  tablewriter appends
-	// excess whitespace to our rows.
-	cleanedString := &strings.Builder{}
-
-	for _, row := range strings.Split(strings.TrimSpace(tableString.String()), "\n") {
-		cleanedString.WriteString(strings.TrimSpace(row))
-		cleanedString.WriteString("\n")
-	}
-
-	fmt.Println(cleanedString.String())
-
 	return nil
 }

-func (data *Table) PrintMarkdown() error {
-	tableString := &strings.Builder{}
-
-	table := tablewriter.NewTable(tableString,
-		tablewriter.WithRenderer(
-			renderer.NewBlueprint(
-				tw.Rendition{
-					Borders: tw.Border{
-						Left:   tw.On,
-						Right:  tw.On,
-						Top:    tw.Off,
-						Bottom: tw.Off,
-					},
-					Settings: tw.Settings{
-						Separators: tw.Separators{
-							ShowHeader:     tw.On,
-							ShowFooter:     tw.Off,
-							BetweenRows:    tw.Off,
-							BetweenColumns: 0,
-						},
-					},
-					Symbols: tw.NewSymbols(tw.StyleMarkdown),
-				})),
-
-		tablewriter.WithConfig(
-			tablewriter.Config{
-				Header: tw.CellConfig{
-					Formatting: tw.CellFormatting{
-						Alignment:  tw.AlignLeft,
-						AutoFormat: tw.Off,
-					},
-				},
-				Row: tw.CellConfig{
-					Formatting: tw.CellFormatting{
-						Alignment: tw.AlignLeft,
-					},
-				},
-			},
-		),
-	)
-
-	table.Header(data.Headers)
-
-	if err := table.Bulk(data.Entries); err != nil {
-		return fmt.Errorf("failed to add data to table renderer: %s", err)
-	}
-
-	if err := table.Render(); err != nil {
-		return fmt.Errorf("failed to render table: %s", err)
-	}
-
-	fmt.Println(tableString.String())
-
-	return nil
-}
-
-func (data *Table) Sort() {
+func (table *Table) Sort() {
 	// sanity checks
-	if len(data.Entries) == 0 {
+	if len(table.Entries) == 0 {
 		return
 	}

-	sort.Slice(data.Entries, func(i, j int) bool {
-		return data.Entries[i][0] < data.Entries[j][0]
+	table.preprocessRows()
+
+	sort.Slice(table.rows, func(i, j int) bool {
+		return table.rows[i][0] < table.rows[j][0]
 	})
 }

-func (data *Table) Addheaders(headers ...string) {
+func (table *Table) Addheaders(headers ...string) {
 	for idx, header := range headers {
-		switch data.Mode {
+		switch table.Mode {
 		case "json", "yaml":
-			data.Headers[idx] = strings.ReplaceAll(strings.ToLower(header), " ", "_")
+			table.Headers[idx] = strings.ReplaceAll(strings.ToLower(header), " ", "_")
 		default:
-			data.Headers[idx] = bold(strings.ReplaceAll(strings.ToUpper(header), " ", "-"))
+			table.Headers[idx] = bold(strings.ReplaceAll(strings.ToUpper(header), " ", "-"))
 		}
+
+		table.RawHeaders[idx] = header
 	}
 }

-func (data *Table) AddRow(fields ...string) {
-	data.Entries = append(data.Entries, fields)
+func (table *Table) AddRow(fields ...any) {
+	table.Entries = append(table.Entries, fields)
+}
+
+func (table *Table) AddRowLate(fields ...any) {
+	table.AddRow(fields)
+
+	if !table.processed {
+		return
+	}
+
+	row := make([]string, len(fields))
+
+	for idx, field := range fields {
+		row[idx] = any2string(field)
+	}
+
+	table.rows = append(table.rows, row)
+}
+
+// needed for json and yaml output
+func (table *Table) toMap() []map[string]any {
+	raw := make([]map[string]any, len(table.Entries))
+
+	for idx, entries := range table.Entries {
+		raw[idx] = make(map[string]any, len(table.Headers))
+		for eidx, entry := range entries {
+			raw[idx][table.Headers[eidx]] = entry
+		}
+	}
+
+	return raw
 }

 // return the length of a string but only visible chars, w/o ansi color escapes
--- a/t/.env
+++ b/t/.env
@@ -0,0 +1,6 @@
+ES_PASS=tuscador1
+STACK_VERSION=9.4.2
+CLUSTER_NAME=domdoc
+LICENSE=basic
+ES_PORT=9200
+MEM_LIMIT=1073741824
--- a/t/Makefile
+++ b/t/Makefile
@@ -0,0 +1,46 @@
+.PHONY: test clean cluster docs search up down delete
+
+# docker stuff
+up:
+	@echo "booting up docker containers"
+	docker compose up -d --remove-orphans
+
+waitup:
+	@echo "wait til es cluster is up and running"
+	mosscap msc-actions.yaml msc-docker.yaml -n -t 300
+
+down:
+	@echo "shutting down docker containers"
+	docker compose down
+
+delete:
+	@echo "delete docker volumes"
+	docker volume rm t_certs t_esdata01 t_esdata02 t_esdata03
+
+clean-docker: down delete
+
+
+# mosscap esctl stuff
+test: up waitup cluster docs wait search
+
+cluster:
+	@echo "setting up elastisearch cluster"
+	mosscap msc-actions.yaml msc-cluster.yaml -n
+
+docs:
+	@echo "put some docs"
+	mosscap msc-actions.yaml msc-docs.yaml -n -c 1000 -p 100
+
+wait:
+	sleep 10
+
+search:
+	@echo "make some searches"
+	mosscap msc-actions.yaml msc-search.yaml -n -t 60
+
+clean:
+	@echo "cleaning up cluster"
+	mosscap msc-actions.yaml msc-clean.yaml -n
+	rm -f *.state debug.log
+
+
--- a/t/README.md
+++ b/t/README.md
@@ -0,0 +1,77 @@
+# Testing
+
+Building regular unit tests would require to create a mock
+elasticsearch cluster, which is too much a chore for a one man
+show. Running a regular elasticsearch cluster on Codeberg CI is not
+economically reasonable.
+
+Therefore I run tests manually. Here's how.
+
+# Dependencies
+
+The following is required:
+
+- linux, any distro will do
+- docker in a decent version
+- [mosscap](https://codeberg.org/scip/mosscap) version `0.0.17` or higher.
+
+# Docker
+
+There's a ready to use docker compose file, which fires up an
+elasticsearch cluster with 3 nodes. To start it manually just execute
+`make up`.
+
+When it's up and running it should look like this:
+
+```console
+$ docker ps
+NAMES     STATUS                   PORTS
+t-es03-1  Up 16 minutes (healthy)  9200/tcp, 9300/tcp
+t-es02-1  Up 16 minutes (healthy)  9200/tcp, 9300/tcp
+t-es01-1  Up 16 minutes (healthy)  0.0.0.0:9200->9200/tcp, [::]:9200->9200/tcp, 9300/tcp
+```
+
+There's an esctl config file `cluster.yaml`, which you can use to
+access that elasticsearch cluster, e.g.:
+
+```console
+$ esctl -c cluster.yaml cluster status 
+DOCKER/DOMDOC              STATUS
+Cluster Name               domdoc
+ES Status                  green
+ES Version                 9.4.2
+Is Leader                  false
+Active Shards              8
+Active Primary Shards      4
+Unassigned Shards          0
+Unassigned Primary Shards  0
+Pending Tasks              0
+Nodes                      3
+Red Indices                0
+Long Running Tasks         0
+```
+
+# Automated Tests
+
+To execute the automated tests, just execute `make test`. This boots
+up the elasticsearch containers, waits until they are up and running,
+creates data on it and queries it.
+
+# Cleanup
+
+To just clean up the elasticsearch cluster run `make clean`.
+
+To remove everything, run `make clean-docker`.
+
+# Reference
+
+## Mosscap configs
+
+| CONFIG           | DESCRIPTION                                                          |
+|------------------|----------------------------------------------------------------------|
+| msc-actions.yaml | contains all actions, used by all item configs                       |
+| msc-docker.yaml  | single item: used to wait until elasticsearch containers are healthy |
+| msc-cluster.yaml | single item: create indices etc                                      |
+| msc-docs.yaml    | generator items: put docs into the index                             |
+| msc-search.yaml  | single item: do some searches                                        |
+| msc-clean.yaml   | single item: clean up the elasticsearch cluster                      |
--- a/t/cluster.yaml
+++ b/t/cluster.yaml
@@ -0,0 +1,7 @@
+# esctl config
+clusters:
+    docker/domdoc:
+        uri: https://elastic:9200
+        user: elastic
+        token: ""
+        default: false
--- a/t/docker-compose.yaml
+++ b/t/docker-compose.yaml
@@ -0,0 +1,207 @@
+services:
+  setup:
+    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+    volumes:
+      - certs:/usr/share/elasticsearch/config/certs
+    user: "0"
+    command: >
+      bash -c '
+        if [ x${ES_PASS} == x ]; then
+          echo "Set the ES_PASS environment variable in the .env file";
+          exit 1;
+        fi;
+        if [ ! -f config/certs/ca.zip ]; then
+          echo "Creating CA";
+          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
+          unzip config/certs/ca.zip -d config/certs;
+        fi;
+        if [ ! -f config/certs/certs.zip ]; then
+          echo "Creating certs";
+          echo -ne \
+          "instances:\n"\
+          "  - name: es01\n"\
+          "    dns:\n"\
+          "      - es01\n"\
+          "      - localhost\n"\
+          "    ip:\n"\
+          "      - 127.0.0.1\n"\
+          "  - name: es02\n"\
+          "    dns:\n"\
+          "      - es02\n"\
+          "      - localhost\n"\
+          "    ip:\n"\
+          "      - 127.0.0.1\n"\
+          "  - name: es03\n"\
+          "    dns:\n"\
+          "      - es03\n"\
+          "      - localhost\n"\
+          "    ip:\n"\
+          "      - 127.0.0.1\n"\
+          > config/certs/instances.yml;
+          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
+          unzip config/certs/certs.zip -d config/certs;
+        fi;
+        echo "Setting file permissions"
+        chown -R root:root config/certs;
+        find . -type d -exec chmod 750 \{\} \;;
+        find . -type f -exec chmod 640 \{\} \;;
+        echo "Waiting for Elasticsearch availability";
+        until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
+        echo "All done!";
+      '
+    healthcheck:
+      test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
+      interval: 1s
+      timeout: 5s
+      retries: 120
+
+  es01:
+    depends_on:
+      setup:
+        condition: service_healthy
+    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+    volumes:
+      - certs:/usr/share/elasticsearch/config/certs
+      - esdata01:/usr/share/elasticsearch/data
+    ports:
+      - ${ES_PORT}:9200
+    environment:
+      - node.name=es01
+      - cluster.name=${CLUSTER_NAME}
+      - cluster.initial_master_nodes=es01
+      - discovery.seed_hosts=es02
+      - ELASTIC_PASSWORD=${ES_PASS}
+      - bootstrap.memory_lock=true
+      - xpack.security.enabled=true
+      - xpack.security.http.ssl.enabled=true
+      - xpack.security.http.ssl.key=certs/es01/es01.key
+      - xpack.security.http.ssl.certificate=certs/es01/es01.crt
+      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.transport.ssl.enabled=true
+      - xpack.security.transport.ssl.key=certs/es01/es01.key
+      - xpack.security.transport.ssl.certificate=certs/es01/es01.crt
+      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.transport.ssl.verification_mode=certificate
+      - xpack.license.self_generated.type=${LICENSE}
+      - xpack.ml.use_auto_machine_memory_percent=true
+      - node_roles=data_content
+      - xpack.searchable.snapshot.shared_cache.size="1gb"
+      - cluster.routing.allocation.disk.threshold_enabled=false
+      - cluster.routing.allocation.disk.watermark.low="2gb"
+      - cluster.routing.allocation.disk.watermark.high="1gb"
+      - cluster.routing.allocation.disk.watermark.flood_stage="500mb"
+    mem_limit: ${MEM_LIMIT}
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
+        ]
+      interval: 10s
+      timeout: 10s
+      retries: 120
+
+  es02:
+    depends_on:
+      - es01
+    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+    volumes:
+      - certs:/usr/share/elasticsearch/config/certs
+      - esdata02:/usr/share/elasticsearch/data
+    environment:
+      - node.name=es02
+      - cluster.name=${CLUSTER_NAME}
+      - cluster.initial_master_nodes=es01,es02
+      - discovery.seed_hosts=es01
+      - ELASTIC_PASSWORD=${ES_PASS}
+      - bootstrap.memory_lock=true
+      - xpack.security.enabled=true
+      - xpack.security.http.ssl.enabled=true
+      - xpack.security.http.ssl.key=certs/es02/es02.key
+      - xpack.security.http.ssl.certificate=certs/es02/es02.crt
+      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.transport.ssl.enabled=true
+      - xpack.security.transport.ssl.key=certs/es02/es02.key
+      - xpack.security.transport.ssl.certificate=certs/es02/es02.crt
+      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.transport.ssl.verification_mode=certificate
+      - xpack.license.self_generated.type=${LICENSE}
+      - xpack.ml.use_auto_machine_memory_percent=true
+      - cluster.routing.allocation.disk.threshold_enabled=false
+      - cluster.routing.allocation.disk.watermark.low="2gb"
+      - cluster.routing.allocation.disk.watermark.high="1gb"
+      - cluster.routing.allocation.disk.watermark.flood_stage="500mb"
+    mem_limit: ${MEM_LIMIT}
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
+        ]
+      interval: 10s
+      timeout: 10s
+      retries: 120
+
+
+  es03:
+    depends_on:
+      - es01
+    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
+    volumes:
+      - certs:/usr/share/elasticsearch/config/certs
+      - esdata03:/usr/share/elasticsearch/data
+    environment:
+      - node.name=es03
+      - cluster.name=${CLUSTER_NAME}
+      - cluster.initial_master_nodes=es01,es03
+      - discovery.seed_hosts=es01
+      - ELASTIC_PASSWORD=${ES_PASS}
+      - bootstrap.memory_lock=true
+      - xpack.security.enabled=true
+      - xpack.security.http.ssl.enabled=true
+      - xpack.security.http.ssl.key=certs/es03/es03.key
+      - xpack.security.http.ssl.certificate=certs/es03/es03.crt
+      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.transport.ssl.enabled=true
+      - xpack.security.transport.ssl.key=certs/es03/es03.key
+      - xpack.security.transport.ssl.certificate=certs/es03/es03.crt
+      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
+      - xpack.security.transport.ssl.verification_mode=certificate
+      - xpack.license.self_generated.type=${LICENSE}
+      - xpack.ml.use_auto_machine_memory_percent=true
+      - cluster.routing.allocation.disk.threshold_enabled=false
+      - cluster.routing.allocation.disk.watermark.low="2gb"
+      - cluster.routing.allocation.disk.watermark.high="1gb"
+      - cluster.routing.allocation.disk.watermark.flood_stage="500mb"
+    mem_limit: ${MEM_LIMIT}
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
+        ]
+      interval: 10s
+      timeout: 10s
+      retries: 120
+      
+volumes:
+  certs:
+    driver: local
+  esdata01:
+    driver: local
+  esdata02:
+    driver: local
+  esdata03:
+    driver: local
--- a/t/msc-actions.yaml
+++ b/t/msc-actions.yaml
@@ -0,0 +1,96 @@
+#
+# this is a mosscap action file, see: https://codeberg.org/scip/mosscap
+vars:
+  esctl: ../esctl -c cluster.yaml
+
+actions:
+  wait: |
+    sleep [[.time]]
+
+  docker_wait: |
+    for i in {1..20}; do
+      count=$(docker ps | grep healthy | wc -l)
+      if test $count -eq 3; then
+        echo "all containers are healthy"
+        exit
+      fi
+      sleep 5s
+    done
+
+    echo "not all containers are healthy"
+    docker ps
+    
+  cluster_ls: |
+    [[.esctl]] cluster ls | grep -E domdoc.*reachable.*yes
+  
+  cluster_status: |
+    [[.esctl]] cluster status | grep green
+
+  create_ilm: |
+    [[.esctl]] ilm create --hot-rollover-max-age 7d \
+                          --hot-rollover-max-primary-shard-size 25g \
+                          --warm-min-age 0 \
+                          --delete-min-age 14d [[.policy]]
+
+  describe_ilm: |
+    [[.esctl]] ilm show [[.policy]] -t | grep -E "rollover when storage > 25g"    
+
+  create_index_template: |
+    [[.esctl]] index template create [[.index]] -i [[.index]] \
+      -s number_of_shards:3 \
+      -s index.sort.field:@timestamp \
+      -r 1m --ilm-policy [[.policy]] \
+      user:keyword message:text @timestamp:date
+
+  describe_index_template: |
+    [[.esctl]] index template show [[.index]] | grep -E "index.sort.field.*@timestamp"
+    
+  create_index: |
+    [[.esctl]] index create -s 2 -r 2 [[.index]]
+
+  describe_index: |
+    [[.esctl]] index show [[.index]] | grep -E "fields.*@timestamp"
+
+  index_ls: |
+    [[.esctl]] index ls | grep [[.index]]
+
+  index_template_rm: |
+    [[.esctl]] index template rm [[.index]]
+    
+  index_rm: |
+    [[.esctl]] index rm [[.index]]
+
+  timestamp: |
+    date --iso-8601=second
+
+  date: |
+    date +%Y-%m-%d
+    
+  doc_add: |
+    [[.esctl]] doc add -i [[.index]] '{"user": "[[.user]]", "message":"[[.message]]", "@timestamp":"[[.ts]]"}'
+    
+  search_any: |
+    [[.esctl]] search -i [[.index]] -l 1 | jq .source.message
+
+  search_date: |
+    [[.esctl]] search -i [[.index]] -l 1 | jq '.source."@timestamp"' | grep [[.today]]
+
+  search_count: |
+    [[.esctl]] search -i [[.index]] -l 5000 | wc -l | grep 1000
+    
+  search_content: |
+    [[.esctl]] search -i [[.index]] [[.content_pattern]] -l 1 | jq .source.message
+
+  search_content_and: |
+    [[.esctl]] search -i [[.index]] [[.content_and_pattern]] -l 1 | jq .source.message
+
+  nodes: |
+    [[.esctl]] node ls | grep es01
+
+  describe_node: |
+    [[.esctl]] node show [[.node]] | grep "Node version"
+
+  license: |
+    [[.esctl]] license show | grep -E "Expires.*never"
+
+
--- a/t/msc-clean.yaml
+++ b/t/msc-clean.yaml
@@ -0,0 +1,14 @@
+#
+# this is a mosscap item file, see: https://codeberg.org/scip/mosscap
+items:
+  - name: docker/domdoc
+
+vars:
+  index: test
+
+tasks:
+  - name: delete_index
+    action: index_rm
+
+  - name: delete_template
+    action: index_template_rm
--- a/t/msc-cluster.yaml
+++ b/t/msc-cluster.yaml
@@ -0,0 +1,48 @@
+#
+# this is a mosscap item file, see: https://codeberg.org/scip/mosscap
+statefile: cluster.state
+
+items:
+  - name: docker/domdoc
+
+vars:
+  index: test
+  node: es01
+  policy: testpolicy
+  
+tasks:
+  - name: ls
+    action: cluster_ls
+
+  - name: license
+    action: license
+    
+  - name: status
+    action: cluster_status
+
+  - name: ilm
+    action: create_ilm
+
+  - name: check_ilm
+    action: describe_ilm
+    
+  - name: template
+    action: create_index_template
+
+  - name: check_template
+    action: describe_index_template
+    
+  - name: index
+    action: create_index
+
+  - name: indexls
+    action: index_ls
+
+  - name: describe
+    action: describe_index
+
+  - name: nodes
+    action: nodes
+
+  - name: check_node
+    action: describe_node
--- a/t/msc-docker.yaml
+++ b/t/msc-docker.yaml
@@ -0,0 +1,12 @@
+#
+# this is a mosscap item file, see: https://codeberg.org/scip/mosscap
+items:
+  - name: docker/domdoc
+
+vars:
+  index: test
+  time: 5s
+
+tasks:
+  - name: wait
+    action: docker_wait
--- a/t/msc-docs.yaml
+++ b/t/msc-docs.yaml
@@ -0,0 +1,21 @@
+#
+# this is a mosscap generator item file, see: https://codeberg.org/scip/mosscap
+vars:
+  index: test
+
+tasks:
+  - name: ts
+    action: timestamp
+
+  - name: add
+    action: doc_add
+    args:
+      ts: ts.result
+  
+generate:
+  user: $name
+  # will become something like:
+  # "content34 iBAXQ2Va Ko5gMwwu FEH2O99B"
+  # so we can search for "content3*" and get multiple matches
+  message: "content$int8 $rand make$int8 $rand"
+  
--- a/t/msc-search.yaml
+++ b/t/msc-search.yaml
@@ -0,0 +1,31 @@
+#
+# this is a mosscap item file, see: https://codeberg.org/scip/mosscap
+items:
+  - name: docker/domdoc
+
+vars:
+  index: test
+  time: 10s
+  content_pattern: "content3*"
+  content_and_pattern: "content3* make"
+
+tasks:
+  - name: today
+    action: date
+
+  - name: search_any
+    action: search_any
+
+  - name: date
+    action: search_date
+    args:
+      today: today.result
+
+  - name: count
+    action: search_count
+
+  - name: content
+    action: search_content
+
+  - name: content_and
+    action: search_content_and
Author	SHA1	Message	Date
Thomas von Dein	c5a21bd677	add esql sample	2026-07-10 15:14:23 +02:00
T. von Dein	f61fda0697	add feature esql search (#90 )	2026-07-10 15:07:57 +02:00
T. von Dein	15dbf7ada0	fix api header spec (#89 )	2026-07-10 13:58:56 +02:00
T. von Dein	311a8474d6	feature/node-usage (#88 )	2026-07-10 13:37:59 +02:00
Thomas von Dein	5644046c78	api repl: print output directly if not json	2026-07-10 11:28:25 +02:00
T. von Dein	9a42b86d62	add support for human readable /_cat endpoints: 'api repl -H' (#87 )	2026-07-10 11:21:45 +02:00
T. von Dein	53abe666e8	fix 'node show' and 'shard explain' crashes (#86 )	2026-07-09 13:41:07 +02:00
Thomas von Dein	1e9e419e9b	fix crash in ByteSize conversion	2026-07-08 15:07:01 +02:00
T. von Dein	c128e32ca1	add more important node stats (#82 )	2026-07-08 15:03:31 +02:00
Thomas von Dein	2969522913	rename var	2026-07-08 15:00:21 +02:00
Thomas von Dein	51480e6b35	add 'index du <index>'	2026-07-08 14:58:07 +02:00
Thomas von Dein	99bf703997	add table.AddRowLate() to add rows after sorting	2026-07-08 14:57:46 +02:00
T. von Dein	76ad6c7afa	remove workaround to load config in root.Before() (#83 ) see: https://github.com/urfave/cli/issues/2348	2026-07-08 14:13:47 +02:00
T. von Dein	8614e09004	show green and failed indices in status, rename red to failed in index ls (#81 )	2026-07-08 10:23:01 +02:00
Thomas von Dein	03cfeb4336	fix go tool	2026-07-08 09:34:58 +02:00
T. von Dein	3d3dfb7a42	fix #79 : remove compatibility header (#80 )	2026-07-08 09:33:22 +02:00
Thomas von Dein	1d45a3cd4c	set go version for releaser	2026-07-08 00:00:37 +02:00
Thomas von Dein	0104e1bf58	fix go releaser go version	2026-07-07 23:53:47 +02:00
Thomas von Dein	2dc716d1c9	fix version newline	2026-07-07 23:49:57 +02:00
T. von Dein	0d63e7c4d2	satisfy full linter (#77 )	2026-07-07 23:46:43 +02:00
T. von Dein	b8e0ee074c	internal/gofix and fix error wrapping (#76 )	2026-07-07 10:41:34 +02:00
T. von Dein	f10366dbde	mv index allocate to shard allocate, add explanations, fixes #71 (#75 )	2026-07-07 08:39:32 +02:00
T. von Dein	c35ffa5e4b	internal/rework-table (#74 )	2026-07-07 07:29:03 +02:00
Thomas von Dein	92865c0fe2	cosmetics	2026-07-06 14:29:36 +02:00
Thomas von Dein	5475b9986d	typo	2026-07-06 14:28:31 +02:00
T. von Dein	82c017144a	various fixes (#70 ) - dont show ccr status if license insufficient - add automated tests - fix config loading - fix search output - fix `license show` panics - fix `ilm show` completion - print ask passwd prompt to stderr	2026-07-06 14:22:59 +02:00
T. von Dein	a07f38e945	add 'license show', add printer.NewTableEmpty() along .WithHeaders() (#69 )	2026-07-03 13:52:36 +02:00
T. von Dein	c197e138ef	fix repl output: didn't print json smaller than term height, add debug-http to api repl as well (#68 )	2026-07-03 13:30:37 +02:00
T. von Dein	fb6f2389fe	add 'cluster settings set' settings completion (#67 )	2026-07-03 12:52:13 +02:00
T. von Dein	c9fb572935	get rid of getJsonPath, use flat_settings query flag instead (#66 )	2026-07-03 10:25:57 +02:00
T. von Dein	1fc2004474	add external pager support via ES_JSON_PAGER (#65 )	2026-07-03 10:07:11 +02:00
T. von Dein	7b576c976c	add option -f to usage and filter support (#64 )	2026-07-03 08:54:19 +02:00
T. von Dein	b51ee109f2	tune cluster ls: parallized and use tcp connect instead of https (#63 )	2026-07-03 08:30:35 +02:00
T. von Dein	b573d63c54	enhance cluster status, add word wrap to wide table rows (#62 )	2026-07-02 12:16:59 +02:00
T. von Dein	e3b96b3e3b	add node show + node clients (#61 )	2026-07-01 13:13:16 +02:00
T. von Dein	6436bcfb22	ask for pass if missing or use env pass, add token support (#60 )	2026-07-01 10:58:39 +02:00
T. von Dein	f5c8a23589	add cluster reroute commands, fix usage width bug (#59 ) fixes #36	2026-06-29 13:08:05 +02:00
T. von Dein	f9eded5f92	enhance ilm show, add ilm update, rename modify to update everywhere (#58 )	2026-06-29 11:48:29 +02:00
T. von Dein	b7a87051c0	add 'ilm show -t' to show a better visualization of a ilm policy (#57 )	2026-06-29 10:11:50 +02:00
T. von Dein	81987b75f2	turn --show-command-tree into sub command, hide hidden commands (#56 )	2026-06-29 08:38:03 +02:00
Thomas von Dein	34bf4fbed9	add ilm forecast example	2026-06-26 11:41:55 +02:00
T. von Dein	a87f6d0c4f	add --hidden flag (default off) to 'index ls' and 'ilm forecast ls' (#55 )	2026-06-26 11:32:53 +02:00
T. von Dein	bbe72a474b	fix #53 : shardsize to string, fix nil pointer, add cold phase (#54 )	2026-06-26 11:25:30 +02:00
Thomas von Dein	e3aa50af37	remove debug print	2026-06-26 10:07:42 +02:00
T. von Dein	d2a0812579	feature add ilm-explain (#52 )	2026-06-26 10:02:41 +02:00
T. von Dein	6200b5e7b0	enhance/ilm-forecast (#51 )	2026-06-26 09:08:14 +02:00
Thomas von Dein	b1b701303c	optimzie virtualAge() a little	2026-06-25 20:30:42 +02:00
Thomas von Dein	8f2c68b5b6	fix index response, fix linter issues	2026-06-25 14:19:43 +02:00
Thomas von Dein	d60983411e	refactored large func	2026-06-25 14:16:35 +02:00
Thomas von Dein	e1291d1d92	add ilm forecast show	2026-06-25 13:29:24 +02:00
Thomas von Dein	5f60696b01	add ilm forecast data collection, generalized parallel api calls	2026-06-25 11:54:06 +02:00
T. von Dein	825b3ce5d1	fix #49 : add ilm policy to index+index-template create+modify (#50 )	2026-06-25 07:52:54 +02:00
Thomas von Dein	75a94fade3	fix doc	2026-06-24 10:30:53 +02:00
Thomas von Dein	3e36f97e4b	upd documentation	2026-06-24 10:29:17 +02:00
Thomas von Dein	1b9309bca0	upd readme	2026-06-24 09:44:21 +02:00
Thomas von Dein	20b79ce168	left align ints by default again, add -I to right align on request	2026-06-24 09:35:40 +02:00
T. von Dein	ffcb8adb70	enhanced default cluster selection, add 'cluster switch', overhaul json header setting (#47 )	2026-06-24 09:25:50 +02:00
Thomas von Dein	3c6819151f	generate command tree from within (esctl --show-command-tree)	2026-06-23 14:02:58 +02:00
Thomas von Dein	faa8c0fe26	fix typo	2026-06-23 14:02:40 +02:00
Thomas von Dein	92ddf4f1f0	spelling fix	2026-06-23 13:04:25 +02:00
Thomas von Dein	76e039d124	fix badges, add release badge	2026-06-23 13:02:43 +02:00
Thomas von Dein	a5ae8f61a9	add anti ai paragraph and badge	2026-06-23 12:57:11 +02:00
Thomas von Dein	9a19473ff1	upd features	2026-06-23 12:35:35 +02:00