Elasticsearch Head alternatives that are still maintained

Where Elasticsearch Head stands#

Elasticsearch Head by Ben Birch is licensed under Apache 2.0 (the LICENCE file carries a 2010 to 2013 copyright). At the time of writing it has about 9.5k stars, 157 open issues and 17 open pull requests. The last tagged release is v5.0.0 from 10 April 2018, and the most recent commit on master dates from 6 November 2020. The repository is public and not archived, so it is better described as dormant than dead.

The README describes four ways to run it: a Chrome extension (no CORS needed), a standalone server started with npm run start on port 9100, Docker images tagged 1, 2 and 5 to match the cluster major version, and the original Elasticsearch site plugin, which the README says is impossible from version 5 and not supported on 5.x, 6.x or 7.x. Basic auth is passed through auth_user and auth_password URL parameters, which the project itself notes travel in clear text without HTTPS. Running the standalone server against a cluster requires http.cors.enabled: true and an explicit http.cors.allow-origin.

None of this means Head stops working tomorrow. It means nobody is testing it against Elasticsearch 8 or 9, current security defaults, or OpenSearch.

What people actually used Head for#

Name the job before choosing a replacement. Head had a handful of screens and most teams used two:

1. The cluster overview, with every index as a row and every shard as a coloured box. This is still the most-copied screen in Elasticsearch tooling.
2. Browsing documents in an index with a simple filter panel.
3. The structured query builder for people who did not want to write Query DSL.
4. Any request, a raw REST editor.

The alternatives below are grouped by which of these they replace.

Maintained alternatives#

ElasticVue (overview, browser, REST)#

ElasticVue is the direct successor in spirit. MIT licence, 2.7k stars, release v1.17.0 on 28 October 2026. It keeps the extension form factor Head users like (Chrome, Firefox, Edge) and adds a desktop app for Windows, macOS and Linux that also skips CORS, plus a hosted web version, Docker image and self-hosted build. Screens cover cluster overview, indices and aliases, shard management, document search and editing, REST queries, and snapshot repositories. The README says it works with every Elasticsearch version including end-of-life ones. The trade-off is the same as Head's: one user, one machine, cluster credentials stored locally, no export of search results documented. More in FlatQL vs ElasticVue and the ElasticVue alternatives roundup.

FlatQL (browser, structured query, any request, plus SQL)#

FlatQL replaces Head's browser and query screens with a SQL worksheet. Instead of a structured-query form you write SELECT service, level, COUNT(*) FROM "logs-*" WHERE status_code >= 500 GROUP BY service, level, and the cluster runs it as a composite aggregation. The Show as DSL panel prints the exact Query DSL beside every result, which is Head's query builder done the other way round. Raw Elasticsearch requests sit in the same worksheet for the "any request" case. Beyond Head, the embedded engine handles JOINs between indices, CTEs and window functions on up to about 50,000 rows per index per statement, and exports stream to CSV, TSV, JSON, NDJSON, Excel and Parquet. It connects to Elasticsearch 6 to 9 and OpenSearch 1 to 2 over the HTTP API with your credentials and installs nothing. It does not do shard allocation, aliases or snapshots, and there is no cluster overview grid. The web app is live; the desktop app is coming soon. Free covers one cluster with no export; Pro is $199 once (pricing).

Cerebro (overview, REST, settings)#

Cerebro is the closest match for the cluster overview grid. MIT licence, Java 11 or newer, port 9000, official Docker images, LDAP login via environment variables. The source has modules for nodes, REST, snapshots, repositories, templates, index settings, cluster settings and _cat output. The caveat is activity: the last release is v0.9.4 (April 2021) and the last commit on main is from July 2021. If you pick Cerebro you are choosing a second dormant project, albeit one about seven years newer than Head's last release. FlatQL vs Cerebro has the detail.

Dejavu (browser, editing)#

Dejavu replaces the browser tab and improves on it. MIT licence, 8.5k stars, release 3.10.0 in September 2025, with examples against OpenSearch 2.17, Elasticsearch 8.15 and 7.10. It runs from Docker on port 1358, from the hosted instance, or as a static client-side app; the web forms need CORS on the cluster. It browses several indices at once with visual filters, edits documents one at a time or in bulk through a query, imports CSV and JSON with a mapping step, and exports a filtered view to JSON or CSV. No cluster overview, no shard view. See FlatQL vs Dejavu.

Kibana Console and Discover (any request, browser)#

If the cluster is Elastic's distribution, Kibana is already there. Console is a REST editor with autocomplete, a 500-request history and copy-as-curl, which covers Head's "any request" tab. Discover browses documents with KQL, Lucene or ES|QL and can export CSV within size limits. Index and shard state live under Stack Management rather than on one grid. Kibana's source is under a triple licence (AGPLv3, SSPL, ELv2), and role-based access control is free since 6.8 and 7.1. The cost is footprint: a server-side service rather than a browser tab. Read FlatQL vs Kibana or the full Kibana alternatives list.

OpenSearch Dashboards (OpenSearch clusters)#

Head never targeted OpenSearch. OpenSearch Dashboards (Apache 2.0, 3.9.0 in October 2026) ships with Dev Tools for REST requests, Discover, a Query Workbench for read-only SQL and PPL with result downloads, and the Security plugin with roles down to document and field level. For OpenSearch users it is the default answer; its SQL is the OpenSearch SQL plugin, without JOINs across indices (FlatQL vs OpenSearch SQL).

DBeaver (table-style browsing)#

DBeaver Community is Apache 2.0 and connects over the Elasticsearch SQL JDBC driver as described in Elastic's DBeaver guide. The paid Enterprise edition bundles the Elasticsearch, Open Distro and OpenSearch drivers. You browse indices as tables and use DBeaver's export wizards, within x-pack SQL's limits: no arrays, sub-selects only when they flatten, and a 10,000-row ceiling on aggregations without a LIMIT. There is nothing for cluster health. See FlatQL vs DBeaver.

Side by side#

Migration notes#

• Keep the extension habit. If what you liked about Head was clicking an icon in Chrome, ElasticVue's extension is the one-to-one move.
• Check CORS before you blame the tool. Head's standalone mode, Dejavu and self-hosted ElasticVue all need http.cors.enabled and an allow-origin on the cluster. Extensions and desktop apps do not.
• Stop passing passwords in URLs. Head's auth_user/auth_password parameters end up in browser history. Every replacement here has a proper credential field, and FlatQL encrypts stored connection credentials server-side so team members never see them (teams).
• Decide what analysis means to you. Head's structured query answered "show me documents matching X". If the real question is "count X by Y across two indices and send me the CSV", that is a SQL job with a streaming export, and the FlatQL vs Elasticsearch Head page shows the same task both ways. You can try it free on one cluster.