Elasticsearch — Cheat Sheet

Tags: elasticsearch, search, nosql, lucene, elk, kibana

Level: intermediate

TL;DR: Distributed, RESTful search and analytics engine based on Apache Lucene, optimized for full-text search and log analytics.

Key concepts

Cluster: A collection of one or more nodes holding the entire data.

Node: A single server participating in the cluster's indexing and search capabilities.

Index: A logical namespace mapping to one or more primary and replica shards.

Document: The basic unit of information that can be indexed, expressed in JSON.

Shard: A single Lucene instance that acts as a low-level worker unit.

Replica: A copy of a primary shard to provide high availability and search scale.

Inverted Index: Core data structure allowing extremely fast full-text searches.

Mapping: Defines how a document and its fields are stored and indexed.

Analyzer: Pipeline consisting of character filters, tokenizer, and token filters.

Typical questions and ready answers

Q: How does the inverted index work?R: I describe it as a dictionary mapping each unique word to a list of documents containing it, enabling rapid lookups instead of full table scans.

Q: What is the difference between text and keyword mapping types?R: I use text for full-text search where data is analyzed and tokenized. I use keyword for exact matching, sorting, and aggregations.

Q: How do you handle deep pagination in Elasticsearch?R: I avoid standard from and size for deep pages to prevent massive memory usage, relying on search_after or Point in Time (PIT) APIs instead.

Q: What is the split-brain problem?R: It happens when a cluster partitions and multiple nodes elect themselves as the master. I prevent this by configuring the minimum master node quorum correctly.

Pitfalls and common mistakes

Trying to modify an existing field mapping type, which usually requires complete reindexing.

Over-sharding, creating too many small shards that drain cluster heap memory and CPU resources.

Returning large payloads unnecessarily without using source filtering.

Neglecting heap sizing; allocating more than 50% of system RAM or crossing the 32GB zero-based compressed oops threshold.

Snippets and commands

// Create an index with specific settings and mappings
PUT /my-index
{
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "title": { "type": "text" },
      "status": { "type": "keyword" },
      "created_at": { "type": "date" }
    }
  }
}

// Basic boolean search query
GET /my-index/_search
{
  "query": {
    "bool": {
      "must": [
        { "match": { "title": "elasticsearch" } }
      ],
      "filter": [
        { "term": { "status": "active" } }
      ]
    }
  }
}