Elasticsearch

Building and operating search and analytics with Elasticsearch.

Quick Start

docker run -p 9200:9200 -e "discovery.type=single-node" -d docker.elastic.co/elasticsearch/elasticsearch:8.17.0
curl -s localhost:9200  # cluster info

When to Use

• Full-text and fuzzy search over documents
• Log and metric analytics (with Kibana)
• Autocomplete and faceted filtering
• Large-scale read-heavy datasets

Best Practices

Mappings

• Define mappings before indexing bulk data
• Choose field types explicitly (keyword vs text)
• Use `text` for search, `keyword` for filter/sort
• Enable dynamic mapping carefully or disable it

Indexing

• Index in bulk batches for throughput
• Use an alias for zero-downtime reindex
• Manage shard count by size and load
• Set refresh interval and replica counts

Queries

• Use `match` for search, `term` for exact values
• Combine with `bool` (must, should, filter)
• Use aggregations for analytics
• Paginate with search_after, not deep from

Operations

• Secure with TLS and auth (xpack)
• Monitor cluster health and shard allocation
• Set disk watermark alerts
• Back up indices and plan disaster recovery

Dependencies

docker run -p 9200:9200 -e "discovery.type=single-node" -d docker.elastic.co/elasticsearch/elasticsearch:8.17.0
# Python client
pip install elasticsearch

Examples

from elasticsearch import Elasticsearch

es = Elasticsearch("https://localhost:9200", basic_auth=("elastic", "password"), verify_certs=False)
print(es.info())

// Mapping: text for search, keyword for filter
PUT /products
{
  "mappings": {
    "properties": {
      "title": { "type": "text" },
      "category": { "type": "keyword" },
      "price": { "type": "float" }
    }
  }
}

# Search with bool query and aggregation
resp = es.search(index="products", body={
    "query": {
        "bool": {
            "must": [{"match": {"title": "laptop"}}],
            "filter": [{"term": {"category": "electronics"}}],
        }
    },
    "aggs": {"by_category": {"terms": {"field": "category"}}},
})

# Bulk indexing
from elasticsearch.helpers import bulk

docs = [{"_index": "products", "_id": str(i), "_source": {"title": f"item {i}", "category": "x"}} for i in range(1000)]
success, _ = bulk(es, docs)

Step-by-Step

1. Plan the index structure and field types.

2. Create mappings and an alias.

3. Index data in bulk with error handling.

4. Write search queries with bool and filters.

5. Add aggregations for analytics dashboards.

6. Tune shards, replicas, and refresh.

7. Secure and monitor the cluster.

8. Set up backups and reindex workflows.

Validation

1. Queries return relevant, correctly ranked results

2. Aggregations match source data

3. Bulk indexing completes without errors

4. Cluster health is green

5. Search latency within budget at load

Troubleshooting

• Mapping conflicts: fix the type mismatch before reindex.
• Slow queries: add filters, tune shards, or use search templates.
• Disk pressure: monitor watermarks; scale or archive old indices.