FlatQL vs Cerebro for Elasticsearch

Cerebro's README opens with the sentence that defines it: "cerebro is an open source(MIT License) elasticsearch web admin tool built using Scala, Play Framework, AngularJS and Bootstrap" (GitHub). It is the tool you open when you want to see which node holds which shard, add an alias, change an index setting or fire a raw REST request at the cluster. FlatQL is the tool you open when you want an answer out of the data: a SQL statement across one or more indices, a chart, a CSV. Cerebro looks at the cluster. FlatQL looks through it.

What Cerebro covers#

The README itself is short on feature prose, so the clearest list is the application's own controllers: aliases, analysis, the cat APIs, cluster changes, cluster overview, cluster settings, create index, index settings, nodes, repositories, REST, snapshots and templates (app/controllers). That is the inventory of an administrator's day: topology, allocation, lifecycle and settings.

Running it is a Java affair. Cerebro "needs Java 11 or newer to run"; you download a release, unpack it and start bin/cerebro, then open port 9000. Windows users can choco install cerebro-es to get it as a service, and official Docker images are published as lmenezes/cerebro (README). Authentication against LDAP is configured through environment variables such as AUTH_TYPE, LDAP_URL and LDAP_BASE_DN, and everything else lives in conf/application.conf.

On activity: the repository has about 5,600 stars and is not archived, but its latest release is v0.9.4, published 10 April 2021 (releases), and the last push was 12 February 2024 (GitHub API). The README does not state which Elasticsearch versions are supported.

What FlatQL covers#

FlatQL connects to Elasticsearch 6 to 9 and OpenSearch 1 to 2 over the HTTP API with your credentials, on Elastic Cloud, Amazon OpenSearch Service, Open Distro or self-hosted clusters. Nothing is installed on the cluster: no plugin, no agent, no cluster users created. You write SQL. Filters, sorts, limits and GROUP BY are pushed to the cluster when they translate exactly; joins, CTEs, window functions, UNION, HAVING and QUALIFY run in an embedded engine on the rows the cluster returned, up to about 50,000 per index per statement. Each result shows what went to the cluster and what ran in the engine, and Show as DSL displays the exact Query DSL.

Around the worksheet sit the things an administrator cares about in a query tool rather than an admin tool: query history with user, connection, duration and rows; shared connections whose credentials are encrypted server-side and never shown to members; roles with read or write per index pattern; and production connections read-only by default.

Comparison#

Where Cerebro is the better fit#

• You are operating the cluster. Shard allocation, unassigned shards, node disk, index settings and aliases are exactly what Cerebro's screens show and change. FlatQL does not touch any of them.
• You need a REST console next to the cluster view. Cerebro's REST tab sends any request, including writes.
• You want snapshot and repository management in a UI rather than from curl.
• You want an MIT-licensed tool you can run in your own network with LDAP in front of it.

Where FlatQL is the better fit#

• You want data, not topology. A typical FlatQL question:

SELECT s.category,
       COUNT(DISTINCT o.order_id) AS orders,
       SUM(o.amount)              AS amount
FROM orders AS o
JOIN suppliers AS s ON s.domain = o.customer_id
WHERE o.currency = 'EUR'
  AND o.placed_at >= DATE_TRUNC('month', CURRENT_DATE)
GROUP BY s.category
HAVING SUM(o.amount) > 10000
ORDER BY amount DESC;

The orders filters are pushed; both indices are fetched up to the engine cap; the join, the HAVING and the final grouping run in the engine, and the result panel says so.

• You want the generated Query DSL shown, so the SQL doubles as a way to learn the request shape.
• Several people need access and none of them should hold the cluster password. FlatQL encrypts the credentials server-side and enforces roles on every request. See security and connect a cluster.
• You need an audit trail of queries. History records user, connection, duration and rows, and groups similar statements by fingerprint. See query history.
• The export is big. Up to 5,000,000 rows stream to disk in six formats.
• The cluster is OpenSearch. FlatQL supports OpenSearch 1 and 2 explicitly.

Using both#

This is the normal arrangement. The person who owns the cluster runs Cerebro, often in Docker next to it, and uses it for allocation, aliases, templates and snapshots. Everyone who needs numbers out of the indices uses FlatQL, with a read-only production connection the owner shared once. Cerebro never needs to see a SQL statement and FlatQL never needs to move a shard.

One practical overlap is the REST console. When an analyst wants the raw DSL to paste into a ticket, Show as DSL gives it to them without leaving the worksheet, which keeps Cerebro's REST tab, and its write access, in the administrator's hands.

For a tool that mixes a little of both, see the elasticsearch-head comparison. For the dashboards and alerting side of running a cluster, see the Grafana comparison.

Note Cerebro facts are from its GitHub repository and the GitHub API as of November 2026. The project's release and push dates are stated above so you can judge its fit with your Elasticsearch version.