RubberDownloadmacOS GUI for
Elasticsearch
and OpenSearch
Everything a cluster needs in one native window — browse, query, write, watch, compare. It opens instantly and never stalls, however large the answer.
macOS 15 or later · Apple silicon and Intel
Any Elasticsearch or OpenSearch cluster
Elasticsearch or OpenSearch, direct or through an SSH tunnel, an HTTP or SOCKS5 proxy, with mTLS where the cluster asks for it. Secrets live in the Keychain.
Indices6
Filter…
customers2 431 908
orders18 402 551
orders-2026.09842 119
products96 340
sessions4 118 002
audit-log731 664
Aliases2
orders-currentorders-2026.09
catalogueproducts
Templates3
customers
orders
1{
2 "query": { "match_all": {} },
3 "from": 0,
4 "size": 100
5}
_id
first_name
last_name
email
city
orders
vip
Judge
Bartoletti
adams.marcelo@yahoo.com
South Gonzalo
14
false
Marisol
Hettinger
m.hettinger@gmail.com
Port Aiyana
3
false
Cornelius
Kemmer
c.kemmer@outlook.com
Lake Ubaldo
128
true
Elouise
Zulauf
elouise@hotmail.com
West Tremaine
41
true
Rodger
Skiles
rodger.skiles@mail.com
North Marjolaine
7
false
Yasmin
Streich
y.streich@proton.me
East Kaylee
62
true
Alanis
Wintheiser
alanis.w@yahoo.com
New Osbaldo
9
false
Bradly
Harber
bradly.harber@mail.com
Kubview
23
false
Maximo
Renner
maximo@fastmail.com
Lake Tremayne
305
true
Delphia
Lubowitz
delphia.l@yahoo.com
Port Sigurd
18
false
Everardo
Koelpin
e.koelpin@gmail.com
Lake Anahi
77
true
Ottilie
Waelchi
ottilie@proton.me
New Camren
5
false
Kadin
Bergnaum
kadin.b@outlook.com
West Lavonne
211
true
|‹‹1–100of2 431 908››|
Default · Productiontook 34 msopensearch 2.9.0
Elasticsearch at native speed, in a real desktop app
Not a browser in a frame. The table, the editors and the trees are the app’s own views, drawn by your own machine: the window opens in a moment, requests and parsing run off the interface thread, and megabytes of JSON come back as a table you can scroll straight away instead of a window that stops answering while it reads.
Everything the job needs, in one window
Documents as a table, not a wall of JSON
Typed, colored cells; every column sorts from its own menu; ⌘F filters what came back. Paging counts past the result window, so a jump to the end lands on the deepest page the cluster serves instead of its error.
Create an index, fix a document, move an alias
Rubber writes as well as it reads: create an index with its shards and aliases, edit the settings of one that exists, point an alias at another index, edit a document as JSON, drop a row straight from the table. Every destructive step asks first and names what it takes with it. And a connection has guard rails — mark it read-only and the app refuses the request, give it a colour and you see which cluster you are on before you press ⌘↩.
Write the request, get the page
A JSON editor that knows the language: comments and trailing commas allowed, the cluster’s own errors underlined where they happened, ⌘↩ to run. Any request exports as cURL.
The query you run every morning, a click away
Save a query or a REST request under a name, keep them in folders and drag them where they belong. A saved one opens in its own tab and remembers where it came from. They live in the app rather than in the cluster — and they came across from Rubber 1 with everything else.
What the cluster is doing right now
Health, shards and nodes at a glance, with search and indexing rates, latency, heap and CPU over the last minutes. Elasticsearch and OpenSearch name some of those counters differently and move them between releases, so what a chart can draw depends on what this cluster reports. It polls only while you are looking at it.
Two documents, side by side
Send a response, a row or a single cell into the diff from its context menu: changed lines tinted, differing characters marked, formatting and key order taken out of the picture. It needs no connection at all, and the result copies out as a patch.
Any cluster, however it is reached
Elasticsearch or OpenSearch, direct or through a jump host, an HTTP or SOCKS5 proxy. The cluster knows you by a password, an API key or a client certificate, and TLS verification is a switch on the connection like the rest. Keys and passwords live in the Keychain, never in a config file.
A layout that stays put
Sidebars on either side of the tabs, sections that move and resize, the editor on any side of the results. Every boundary you drag is where you left it next time, and ⌘⇧P reaches the rest.
Your setup is a file you own
Connections, groups and saved requests export as one JSON file — a backup, or the ten seconds it takes to set up a second Mac. Passwords and keys are not in it: they stay in the Keychain, and an imported connection asks for its secret the first time it is used. Coming from Rubber 1 there is nothing to export at all — the update finds your data and brings it across.
Quit whenever. Come back to the same session
Every window opens on the tool it was on, with its tabs in order and the one you were reading in front. Unsaved queries, the page the cluster answered and how far you had scrolled come back with them. What is kept is yours to decide: a size limit per tool, or nothing kept at all.
Smaller things you notice on the second day
Command palette
Every action with its shortcut, a keystroke away: ⌘⇧P.
Find and sort
⌘F filters the table and marks every match in the scrollbar. Columns sort from their own menu.
Send to diff
Any row, any cell, any response goes straight into a comparison from its context menu.
Copy it the way you need it
A request as cURL, a document as JSON, rows as an array or a line each, a diff as a patch.
The real total, not “10 000+”
A search stops counting at the index’s result window. One click asks the cluster for the exact number of matches instead.
Paging and sorting edit your query
Next page, or a column’s sort, rewrites
from,sizeandsortin the body in front of you — comments and formatting kept.Bulk without the newlines
Write a
_bulkbody as a plain JSON array of objects; it goes to the cluster as NDJSON, trailing newline and all.Themes, or a prompt for one
Rubber One Dark and Light out of the box. With Pro, import a theme — or copy a prompt and have an AI write it.
Switch cluster in place
⌘O points the window at another connection — Elasticsearch or OpenSearch, it makes no difference — and ⌘↩ opens it in a new one.
Pin what you use
Star an index or an alias and it stays at the top of the sidebar, whatever the filter says.
Your size
One setting scales the interface; the editor and the table have their own, down to row height and tab width.
Keep only what is worth keeping
Responses and comparisons come back after a relaunch — with a size limit per tool, or none at all.
Why not just a browser tab?
Kibana Dev Tools, a web client, curl in a terminal — they all work, and so does Rubber, on Elasticsearch and on OpenSearch alike. This is what changes when the client is a window of its own.
| In a browser tab | In Rubber |
|---|---|
| One query at a time; a second one means another tab of the whole console | A tab per query in every tool, and they are all still there after a relaunch |
| The page parses a large response and stops answering while it does | Requests and parsing run off the interface thread — the table scrolls straight away |
| Paging past the result window ends in the cluster’s error | Paging asks the cluster how deep it may go and stops at the deepest page it serves |
| Credentials live in a browser profile, or are typed in again | Passwords, API keys and certificates live in the macOS Keychain |
| A cluster behind a jump host needs a port forwarded by hand first | An SSH tunnel, an HTTP or a SOCKS5 proxy, set per connection |
| Nothing stands between a stray DELETE and production | A connection marked read-only refuses mutating requests outright |
| The queries you rely on sit in browser storage | Saved requests live in a tree you arrange, and export as a file you keep |
| A response is JSON you read line by line | A response is a typed table you sort, filter with ⌘F and send into a diff |
Free to use. Pro when it is your job.
The free version is the whole app, with limits. Rubber Pro lifts them and covers commercial use.
Free
$0forever
For most work, this is the whole app.No account, no trial clock.
- Viewer, REST console, cluster dashboard and JSON diff
- Create, edit and delete indices, aliases and documents
- SSH tunnels, HTTP and SOCKS5 proxies, mTLS, read-only connections
- Saved requests, restored sessions, export and import of your setup
- One connection window
- Three tabs per tool
- Personal use
SubscriptionPro
$4.17/ month
Billed $49.99 once a year — 30% off the monthly plan.
- Everything in the free version
- Unlimited connection windows
- Unlimited Viewer, REST and diff tabs
- Documents in tabs
- Comments and trailing commas in request bodies
- Custom themes
- Commercial use
- Cancel whenever — the app stays as the free version
LifetimePro
$179once
Rubber Pro without a subscription.Paid once, for good.
- Everything in Rubber Pro
- No renewal, no expiry date
- Includes the updates we publish for the app
- Bought on one Apple ID, like any App Store purchase
Every plan is bought inside the app through the App Store. Cancel a subscription any time in your Apple account; the one-time purchase has nothing to cancel. Prices are in US dollars; the App Store charges in your currency.
Questions that come up
How do I get started?
Download Rubber from the Mac App Store, point a connection at your cluster and run the first query. There is no account to make and no trial clock: the free version works from the moment the window opens.
Is Rubber a Kibana alternative?
For everyday work with a cluster, yes. What you go to Kibana Dev Tools for — write a request, read what came back, look through indices and aliases, watch health, shards and nodes — Rubber does in a native macOS window, with nothing to deploy next to the cluster and no browser tab in between.
Which versions of Elasticsearch and OpenSearch are supported?
Elasticsearch 6, 7, 8 and 9, and every version of OpenSearch. The differences between them are handled one at a time rather than wished away: a total arrives as a bare number from one version and as an object from the next, counters are renamed and moved between releases, and OpenSearch drops a few of them altogether. A counter your cluster does not report costs a point on a chart, never the chart. The cluster itself can be reached directly, through an SSH tunnel, or through an HTTP or SOCKS5 proxy, with mTLS where it asks for one.
Can I use Rubber for free?
Yes. The free version is the whole app — the Viewer, the REST console, the cluster dashboard and the JSON diff — with limits: one connection window, three tabs per tool, personal use. Rubber Pro lifts the limits and covers commercial use.
Where do my passwords and keys live?
In the macOS Keychain, like every other credential on the machine. Rubber talks to your cluster and to nothing else: no account, no server of ours in between, and nothing about what is inside your indices leaves the Mac.
What happens on a large response?
It comes back as a table you can scroll straight away. Requests and parsing run off the interface thread, so the window keeps answering while megabytes of JSON are being read, and paging counts past the result window instead of stopping at the cluster’s error.