_sourceElasticsearch keeps the original JSON document in a field called _source. The source field serves special purposes such as...
AggregationThe aggregations framework is a tool built in every Elasticsearch deployment. The different aggregation types: Bucket, Metric & Pipeline...
AliasIn Elasticsearch, an alias is a secondary name to refer to one or more indices. Aliases can be created and deleted dynamically using...
Autocomplete SearchThere are various approaches for autocomplete in Elasticsearch. Here are some tips & examples for choosing the approach best suited to your...
Bootstrap ChecksElasticsearch carries out "bootstrap checks" to ensure that important settings have been set correctly. If any of these fail, ES won't start.
BulkElasticsearch bulk makes it possible to perform many write operations in a single API call, which increases indexing speed. Using bulk API...
Circuit BreakersElasticsearch has circuit breakers to deal with OutOfMemory errors that cause nodes to crash. Each breaker is used to...
ClientOfficial Elasticsearch clients are available for java, javascript, Perl, PHP, python, ruby and .NET. To avoid surprises, keep your client....
ClusterAn Elasticsearch cluster consists of a number of servers (nodes) working together as one to store data and respond to requests. It enables...
Cluster Blocks Read-OnlyA read-only delete block can be applied automatically by the cluster because of a disk space issue. It can also be applied manually by...
Dangerous Default SettingsCluster name and data path are default settings that could be destructive for proper Elasticsearch function if handled incorrectly. If you...
Dedicated Client NodesMany clusters use coordinating or ingest nodes, while others leave the ingest and coordination functions to the data nodes. In order to...
Dedicated Master NodeOnce an Elasticsearch cluster reaches a certain size, it's recommended to create 3 dedicated master nodes. Here is how you can create...
DELETEDELETE is an Elasticsearch API which removes a document from a specific index. It requires an index name and _id document in order to...
Delete By QueryElasticsearch delete by query is an API, which provides functionality to delete all documents based on the matching query. If you don't...
DeprecationTo find out which functions have been deprecated in Elasticsearch, you can use deprecation logs, deprecation API, read breaking pages...
DiscoveryDiscovery occurs when an Elasticsearch node starts, restarts or loses contact with the master node. In those cases the node needs to...
Disk WatermarkThere are various watermark thresholds on an Elasticsearch cluster. As the disk fills up on a node, the 1st threshold to be crossed is...
DiskThresholdElasticsearch uses several parameters to enable it to manage hard disk storage across the cluster, such as...
DocumentEach Elasticsearch document is a JSON structure, which is ultimately considered to be a series of key:value pairs. An example for creating...
Elasticsearch Async SearchThe Elasticsearch async search API retrieves many data in a stream fashion instead of a single request. To limit the maximum response size...
Elasticsearch Boolean QueriesThere are 4 types of Elasticsearch boolean clauses: filter, must, should & must_not. A single bool query can contain a mix of them. To use...
Elasticsearch Boosting QueryElasticsearch boosting query is used to return only documents that match a positive query while minimizing the score of documents that...
Elasticsearch Cluster StateElasticsearch clusters need to maintain the cluster state in memory on each and every nodes, which requires a large amount of resources...
Elasticsearch CollapseThis guide discusses the Elasticsearch collapse feature, including use cases, how to implement it, and best practices for optimizing...
Elasticsearch CompressionElasticsearch provides various compression techniques to optimize storage and network usage. Here's how to compress an index, source and...
Elasticsearch Constant Score QueryIn Elasticsearch, the constant score query wraps other queries by executing them in a filter context. To implement constant_score query...
Elasticsearch Curl DeleteThis guide will focus on how to use cURL to perform delete operations in Elasticsearch. It covers best practices, common issues & examples.
Elasticsearch Data StreamThe Elasticsearch data stream is an abstraction layer between the names used by applications to facilitate ingestion and search operations...
Elasticsearch Delete DocumentIn this guide, we will discuss the process of deleting documents in Elasticsearch as well as best practices for deleting documents.
Elasticsearch Document Size LimitThis guide discusses the default document size limit in Elasticsearch, the reasons behind it, and how to handle larger documents effectively.
Elasticsearch DSL Exists QueryThe exists query is used for returning the documents that have an indexed value for a specific field, which means it returns the documents...
Elasticsearch Explain APIThe Elasticsearch Explain API is very useful for trying to understand why any particular document got a specific score. Examples of...
Elasticsearch Filtered AliasesElasticsearch filtered aliases can help you filter data more efficiently. To create a filtered alias, you need to define the criteria for...
Elasticsearch Fuzzy QueryElasticsearch fuzzy queries offer a powerful way to handle imprecise search terms. To fine-tune the behavior of fuzzy queries...
Elasticsearch Health Check CurlA common method to perform an Elasticsearch health check is by using cUR. Here's how to use cURL to check the health of your cluster.
Elasticsearch Index ManagementEfficient management of Elasticsearch indices is crucial for maintaining optimal performance. The best practices to manage your index list...
Elasticsearch Index PatternElasticsearch index patterns allow you to define how to match & interact with multiple indices. The best practices for index pattern usage...
Elasticsearch Insert DocumentThis guide will discuss best practices & performance optimization techniques for inserting documents into Elasticsearch. First, use the API...
Elasticsearch Interval QueriesElasticsearch Intervals query provides control over the words & their positions in a text that is required for a document to match a...
Elasticsearch Keyword vs. TextElasticsearch keyword vs. text vs. wildcard vs. text field types. All have different features and are ideal for different use cases
Elasticsearch Minimum_should_matchThe `minimum_should_match` parameter in Elasticsearch plays a crucial role in fine-tuning the relevance of search results. An Example...
Elasticsearch Msearch_Msearch in Elasticsearch allows you to send multiple search requests within a single HTTP request. The Multi-Search API...
Elasticsearch Multi Index QueryMulti-index queries in Elasticsearch allow users to search for documents across several indices simultaneously. To query multiple indices...
Elasticsearch Multiple IndexesThis guide discusses best practices and performance optimization techniques when working with multiple indexes in Elasticsearch.
Elasticsearch Nested Aggregation Elasticsearch nested aggregation is a powerful technique for analyzing complex data structures that contain nested documents. To use...
Elasticsearch Nested QueryAn Elasticsearch nested query is used to search for documents containing specific criteria within these nested objects. To implement...
Elasticsearch Not Indexed FieldThis guide focuses on how to handle not indexed fields in Elasticsearch, including use cases, how to configure them, and examples.
Elasticsearch Not Null QueryHere's how to create not null queries in Elasticsearch, which will help you find documents with existing or missing fields.
Elasticsearch Percolate QueryThe Elasticsearch percolate query is a unique and valuable feature that allows users to perform reverse searches. To implement it...
Elasticsearch Python ExampleIn this guide, we'll walk through an example of using the Elasticsearch Python client, Elasticsearch-py, to index & search documents.
Elasticsearch Query DSL ExamplesThis guide explores best practices for constructing Elasticsearch queries, focusing on the Query DSL (Domain Specific Language). To create...
Elasticsearch Query Match AllThe Elasticsearch match_all query allows users to retrieve all documents within an index or multiple indices. To use Match_all...
Elasticsearch ReleasesIn this article, we will discuss Elasticsearch releases. including versioning system, compatibility considerations, and upgrade strategies.
Elasticsearch Searchable SnapshotsElasticsearch searchable snapshots allow data exploration. They can be controlled with ILM Policies or be manually mounted. To implement...
Elasticsearch Shingles ExampleShingles, also known as word N-grams, are a useful technique for improving the relevance of search results in Elasticsearch. Examples...
Elasticsearch Split Index APIBy using the Elasticsearch Split Index API, an existing index can be split to create a new index with extra primary shards. To do this...
Elasticsearch Sum AggregationThe Elasticsearch sum aggregation allows you to calculate the sum of a numeric field for a set of documents. To implement...
Elasticsearch Synthetic _source The synthetic _source mode in Elasticsearch is used to configure an index so that it saves storage space & doesn't duplicate data. To setup...
Elasticsearch Task Management APIThe Elasticsearch task management API helps you manage long-running tasks. To create, monitor, cancel & retrieve the results of tasks...
Elasticsearch Token FiltersA tokenizer decides how Elasticsearch will take a set of words and divide it into separated terms called “tokens”. To work with synonyms...
Elasticsearch Truncate FieldIn this article, we will discuss various techniques and best practices for truncating fields in Elasticsearch. First...
Elasticsearch UpsertUpsert in Elasticsearch allows you to perform both update and insert actions in a single request. To perform an upsert operation...
Elasticsearch_disk_usage APIThe Elasticsearch _disk_usage API helps get information about disk usage for each analyzed field of indices and/or data streams. To use it...
Enable Adaptive Replica SelectionAdaptive replica selection is a process that prevents a distressed Elasticsearch node from delaying the response to queries. To enable it...
FielddataIn Elasticsearch the term Fielddata is relevant when performing sorting and aggregations on text field. To set fielddata=true, you...
File DescriptorsFile descriptors are required to keep track of all the files Elasticsearch has open at any given time, as well as all network...
FilterElasticsearch Filters apply conditions inside the query to narrow down the matching results. A filter clause can be used used in...
Flood Stage Disk WatermarkWhen the “disk flood stage” threshold is exceeded on an Elasticsearch cluster, it will start to block core actions. To resolve this issue...
Flush, Translog and RefreshIn Elasticsearch, flush is the process of permanently storing data onto the disk for all of the operations that have been stored in memory.
Heavy Merges Were DetectedHeavy merges use CPU, memory and disk resources, which can slow down the cluster’s response speed. In order to fix...
High Cluster Pending TasksElasticsearch cluster pending tasks are updates to the cluster state that were initiated by a user or the cluster. To resolve, list the...
High CPUHigh CPU is often a symptom of other underlying issues. It should be fixed because a distressed node will slow query response time and...
High Disk WatermarkHigh disk watermark is one of the various thresholds on your Elasticsearch cluster. Passing this threshold is a warning and you should not...
High Management QueueA high number of tasks in management queue can cause Elasticsearch cluster instability which could result in data loss. To resolve...
Index Lifecycle Management & PolicyIndex lifecycle management helps automate the creation, management & removal of an Elasticsearch index. Define the index lifecycle policy...
Index Queue Size Is HighOnce an indexing queue exceeds the maximum size, the Elasticsearch node will start rejecting index requests. To resolve this, check the...
IndexingIndexing is the process of adding or updating new documents to an Elasticsearch index. In its simplest form, you can index a document by...
Indexing Failed in ElasticsearchThe causes for indexing failure in Elasticsearch can be broken into 2 areas: index-related & node-related failures. To resolve...
Lack of QuorumThis error occurs when the Elasticsearch cluster doesn't have a quorum of nodes with voting rights to elect a new master node. To resolve...
Loaded Client NodesA saturated coordinating node could cause an increase in search or indexing response latency. This can be fixed by putting a load balancer...
Loaded Data NodesSometimes you can observe that the CPU and load on some of your data nodes is higher than on others. This can occasionally be caused by...
Loaded Master NodesAn overloaded master node may cause instability in the cluster. There are 3 ways to fix loaded master nodes: (1) Checking for...
Low Disk WatermarkLow disk watermark is one of the various thresholds on your Elasticsearch cluster. Here are possible actions you can take to resolve...
LuceneElasticsearch Lucene or Apache Lucene is an open-source Java library used as a search engine. Elasticsearch is built on top of Lucene...
MappingMapping contains the properties of each field in the index. A common issue in Elasticsearch is an incorrectly defined mapping. Examples of...
Master Node Not DiscoveredAn Elasticsearch cluster requires a master node to be identified in the cluster. Reasons why a master node is not discovered yet include...
Max Shards Per Node ExceededIf the max of shards per node is exceeded in Elasticsearch, shards can't be allocated. It is crucial to check if the limit is set at a...
Memory Usage GuideThe Elasticsearch process is very memory intensive. Here are the memory requirements and some tips to reduce your Elasticsearch memory usage.
MetadataElasticsearch metadata refers to additional information stored for each document using metadata fields. Metadata fields can be customized...
Misuse of WildcardsIt's possible to reduce the risk of accidental deletion of indices by preventing the use of wildcard for destructive operations. To check...
Named QueriesNamed queries allow you to label your queries with a name. Named queries can be utilized in a variety of use cases such as...
Node DisconnectedAn Elasticsearch node can disconnect from a cluster for several reasons, including: excessive garbage collection from JVM, configuration...
NodesThere are different types of nodes in Elasticsearch. Each has its own role and purpose. Master, coordinating and data nodes differ...
Number of Master NodesMaster nodes are responsible for actions such as creating or deleting indices. If you don't have enough master nodes, it could lead to...
OvershardingA large number of shards on an Elasticsearch cluster requires extra resources. Learn key ways to avoid and correct oversharding...
PersistentIn Elasticsearch, Persistent refers to cluster settings that persist across cluster restarts. This setting is used in Cluster Update API...
PluginsPlugins in Elasticsearch are used to extend the functionality of Elasticsearch. An Elasticsearch plugin is installed and removed using the...
QueueQueues in Elasticsearch exist in the context of Thread Pools. Queues are used to hold the pending requests for thread pools instead of...
RebalanceCluster rebalancing is the process by which an Elasticsearch cluster distributes data across the nodes. To force rebalance manually...
RecoveryIn Elasticsearch, recovery refers to the process of recovering an index or shard when something goes wrong. You can recover data by using...
Red StatusElasticsearch red status indicates not only that the primary shard has been lost, but also that a replica has not been promoted...
Refresh IntervalElasticsearch requires a refresh operation to make indexed information available for search. You can set the refresh interval by...
Register Snapshot RepositoryTo create & restore snapshots, you need to register a snapshot repository with every Elasticsearch node in the cluster. Here are the steps...
ReindexReindex in Elasticsearch refers to copying existing data from a source index to a destination index. In some scenarios, the reindex API is...
ReplicaIn Elasticsearch there are two types of shards: the primary shard & the replica copy. Each replica is located on a different node to ensure...
ReplicationElasticsearch replication refers to storing a redundant copy of the data. Elasticsearch creates 1 primary shard with a replication factor...
RepositoryAn Elasticsearch repository needs to be registered using the _snapshot endpoint. The supported repository types are: S3, HDFS, Azure...
Rest-high-levelRest-high-level is built on top of low-level rest-client and is a method of communicating with Elasticsearch based on HTTP REST endpoints...
RestoreIn Elasticsearch, restore refers to a snapshot restore mechanism. To restore a cluster from the snapshot, an index, or selected indices...
RoutingIn Elasticsearch, routing refers to document routing. When you index a document, Elasticsearch will determine which shard will be used...
ScrollThe Elasticsearch scroll API is useful when a search returns a large set of results. Large search results are exhaustive for the system...
SearchTo search in Elasticsearch, send a GET request to the _search endpoint in the search API. In the query phase and the fetch phase there are...
Search is Slow in nodesNamesThere are a number of possible causes for slow searches on particular nodes. To correct the issue and improve search performance, you...
Search LatencyThis guide explores how to reduce Elasticsearch search latency based on a key study. The first lesson is to always...
Search Rejected QueueAn Elasticsearch cluster can start to reject search requests for several reasons. To resolve this, check the state of the thread pool and..
SettingsElasticsearch settings can be configured on the cluster-level, node-level and index-level. Here's how to set up and optimize your settings...
Shard Allocation is UnbalancedShard allocation is an algorithm by which Elasticsearch decides which unallocated shards should go on which nodes. To resolve unbalanced...
ShardsThe number of shards is set when an index is created, and cannot be changed without reindexing. To handle unassigned Elasticsearch shards...
Shards Too Large - Shard SizesIt is a best practice that Elasticsearch shard size should not go above 50GB for a single shard. If you go above this limit...
Slow Indexing in NodesIf the indexing queue is high/causes timeouts, it hints that Elasticsearch nodes can't keep up with the indexing rate. To fix slow indexing...
Slow Query Troubleshooting GuideThere are several potential reasons for a slow query in Elasticsearch. Slow logs can be used to detect & troubleshoot slow queries issues...
SnapshotAn Elasticsearch snapshot is a backup of an index taken from a running cluster. It's better to use snapshots instead of disk backups due...
Split BrainElasticsearch split brain occurs when there is more than one master in the cluster. By setting the quorum of minimum master nodes...
TaskA task is equivalent to an Elasticsearch operation, any request performed on an Elasticsearch cluster. The following commands are used...
TemplateAn Elasticsearch template falls into one of these categories: index templates or search templates. Examples of index templates include...
ThreadpoolElasticsearch threadpools are used to manage how requests are processed and to optimize the use of resources. The write threadpool...
UpgradeAn Elasticsearch upgrade of an existing cluster can be done in 2 ways: through a rolling upgrade or a full cluster restart. To upgrade...
VersionA version corresponds to the Elasticsearch built-in tracking system that tracks the changes in each document. By using _version...
X-Pack Basic Security is OffThe popularity of Elasticsearch has made it a target for hackers. It's important to protect your cluster by enabling X-Pack Security...
Yellow StatusYellow status indicates that one or more of the replica shards on the Elasticsearch cluster are not allocated to a node. This could occur...
Zen Discovery SettingsZen discovery settings for cluster formation were deprecated in Elasticsearch V.7 and should be removed from version 7 and above due to...