home
›
cheatsheets
›
database_technologies
›
elasticsearch
Free to read Every card and diagram, and Quiz me
2
Free account Star cards. Your Quiz me marks are kept, so next time you drill just what you missed
3
Pro All 49 answers on this sheet, My sheet across every topic, and PDFs
A free account keeps your stars and Quiz me marks. Pro adds all 49 answers on this sheet, My sheet across every topic, and PDFs.
/
Read
Quiz me
Comfortable
Compact
0
Click a command to copy it
Done 0 /0
To review 0
On this sheet
01 Cluster, shards & nodes02 Documents & writes03 Analysis & mappings04 Query DSL & relevance05 Aggregations06 Index management07 Monitor, secure & tune
The model Elasticsearch splits an index into primary shards , each a Lucene index. hash(_routing) % primaries picks a document's shard, so the primary count can't change once the index exists. A replica is a copy of a primary on another node. It takes over when the primary fails, and it serves searches too. Search is near real time . A write goes to a memory buffer and the translog . A refresh , every second by default, makes it searchable. An analyzer splits a text field into terms. The inverted index maps each term to the documents that hold it. A keyword field keeps the whole value as one term. In filter context , a clause only decides whether a document matches, and Elasticsearch can cache the result. In query context , it also adds to the BM25 relevance score. A write goes to one primary, picked by a hash of _id, then to its replicas. A search asks one copy of every shard for its top hits, then fetches them.
Cluster, shards & nodes how one index spreads across machines What Elasticsearch is Say what Elasticsearch is A distributed search and analytics engine on Lucene. Teams use it for full-text search, logs and metrics.
Say how it differs from a relational database It scales out by adding nodes and stores denormalized JSON. It has no joins or ACID transactions.
Name the parts of the ELK Stack Logstash parses data, Elasticsearch stores and searches it, and Kibana shows it.
Trap An index is closer to a table than to a database. 8.0 removed mapping types, so each index has one mapping.
Shards and replicas Create an index with 3 primaries, 1 replica each "number_of_shards": 3 "number_of_replicas": 1
Change the replica count PUT /logs/_settings You can change it any time. The primary count is fixed.
Say how a document picks its shard hash(_routing) % primaries, where _routing defaults to the _id.
Give an index more primaries POST /logs/_split/logs-split It builds a new index, because the primary count can't change.
Add a data node elasticsearch -E cluster.name=prod Elasticsearch moves shards onto it.
Tip Aim for 10GB to 50GB a shard. Plan enough shards so new nodes have some to take over.
Trap A replica never shares a node with its primary. On a one-node cluster, replicas stay unassigned and health is yellow.
Node roles and failover Run a dedicated master node node.roles: [ master ] The elected master creates indices and allocates shards.
Store shards and run searches node.roles: [ data ]
Transform documents before indexing node.roles: [ ingest ]
Only route requests and merge results node.roles: [ ] Every node coordinates too.
Say what happens when a node fails A replica takes over each lost primary. Then Elasticsearch builds new replicas on the healthy nodes.
Say how Elasticsearch prevents split brain (7.0+) A master needs votes from a majority, so only one side of a network split can elect one.
Pick how many master-eligible nodes Three. An election needs a majority, so three survive losing one.
Tip With no node.roles, a node takes every default role. Use dedicated roles in production.
Trap Before 7.0, a wrong discovery.zen.minimum_master_nodes allowed split brain. 8.0 removed the setting.
OpenSearch and Solr Say what OpenSearch is A fork of Elasticsearch 7.10.2 that AWS made in 2021, under the Apache 2.0 license.
Say how Solr differs It's also built on Lucene, but SolrCloud needs ZooKeeper. Solr is Apache 2.0 and uses XML configuration.
Trap Elasticsearch hasn't been Apache 2.0 since 2021. It's Elastic License 2.0 or SSPL, plus AGPLv3 since 2024.
Documents & writes write, read and version one document CRUD and bulk Create a document, or replace it PUT /users/_doc/1 It overwrites the whole document if ID 1 exists.
Write only if the ID is new PUT /users/_create/1 It fails with 409 Conflict if the ID exists.
Read a document GET /users/_doc/1
Change some fields POST /users/_update/1 Send the changed fields in doc.
Delete a document DELETE /users/_doc/1
Send many writes in one request POST /_bulk Put an action line before each document. Aim for 1 to 15MB a request.
Delete every document that matches a query POST /logs/_delete_by_query
Trap An update still rewrites the whole document. Segments never change, so Elasticsearch only marks the old version deleted.
Versions and conflicts Write only if nobody changed it since you read it ?if_seq_no=2&if_primary_term=1 Send back the _seq_no and _primary_term you read.
Use the version from your source database ?version=100&version_type=external Elasticsearch writes only if your version is higher.
Tip On a 409 conflict, read the document again and retry.
Trap Since 7.0 you can't check for conflicts with the internal _version. It only counts changes.
Refresh and the translog Say when a new document becomes searchable After the next refresh, every second by default.
Make one write searchable at once ?refresh=true It forces a refresh, which is expensive.
Wait until the write is searchable ?refresh=wait_for
Refresh an index less often "refresh_interval": "30s" -1 turns it off for a bulk load.
Say why an acknowledged write survives a crash The translog, a write-ahead log synced on every request. Elasticsearch replays it on restart.
Tip A refresh writes a new Lucene segment. A flush commits segments to disk and starts a new translog.
Analysis & mappings how each field is analyzed and stored Analyzers and the inverted index Say what an inverted index is A map from each term to the documents that hold it, like the index of a book.
Say why it's fast A search looks up its terms and merges their document lists. It never scans documents.
Name an analyzer's steps, in order Character filters clean the text, a tokenizer splits it, and token filters change the tokens.
Name the built-in analyzers standard, the default, plus simple, whitespace, keyword and english.
Build a custom analyzer "tokenizer": "standard" "filter": ["lowercase", "stop"] Define it under analysis in the index settings.
Trap Token filters run in order. Put lowercase before stop, or stop misses The.
Text or keyword field Full text Exact Sort, aggs
"type": "text" Search a field word by word
"type": "keyword" Match, sort or aggregate the whole value
"fields": {"keyword": {"type": "keyword"}} Search name, and sort on name.keyword. Get both from one field
Tip Dynamic mapping sets ignore_above: 256 on .keyword, so longer strings can't be matched exactly.
Mappings and dynamic mapping Show an index's mapping GET /products/_mapping
Name the main field types text, keyword, long, double, date, boolean, object, nested, geo_point and ip.
Say what type a new field gets A string becomes text plus .keyword, or date if it looks like one. A whole number becomes long.
Reject documents with unknown fields "dynamic": "strict" false keeps them in _source but doesn't index them.
Map every new string as keyword "match_mapping_type": "string" Put it in a dynamic template.
Tip A field for every new key is a mapping explosion. An index allows 1,000 fields by default.
Trap You can add fields, but you can't change an existing field's type. That needs a new index and a reindex.
Doc values and fielddata Say what sorting and aggregations read Doc values, an on-disk copy of each field's values, stored by column. text fields have none.
Aggregate on a text field anyway "fielddata": true It loads the field into the JVM heap. Use a keyword sub-field instead.
Tip Set "doc_values": false on a field you never sort or aggregate on. It saves disk.
Relationships without joins Model related data, by default Denormalize. Copy the author's name into every post.
Keep each object in an array separate "type": "nested" Each object becomes a hidden document. Search it with a nested query.
Change children without reindexing the parent "type": "join" Parent and child share a shard. has_child queries are slow.
Trap Elasticsearch flattens an object array. Alice rated 5 and Bob rated 1, so a search for alice with a 1 still matches.
Query DSL & relevance find documents and rank them Match, term and range queries Search a text field {"match": {"title": "quick brown"}} It analyzes the text, then matches any of the terms.
Match an exact value {"term": {"status": "active"}} It skips analysis. Use it on keyword fields, numbers and IDs.
Match a range of numbers or dates {"range": {"price": {"gte": 10}}}
See the terms an analyzer makes GET /_analyze Send analyzer and text. It lists each token with its position.
Trap A term query on a text field often finds nothing. The index holds quick and brown, not Quick Brown.
Bool queries and filter context Drops docs Scored Can cache
must Require a match that adds to the score
filter Require a match, skip scoring
should Rank a match higher
must_not Leave out matches
Tip Put exact conditions, like status, IDs and dates, in filter. Keep full-text conditions in must.
Trap With no must or filter, at least one should must match. Otherwise should only adds score.
Relevance scoring Name the default scoring model BM25. A term counts more when it repeats, when it's rare, and when the field is short.
Weight one clause twice as much "boost": 2 For your own formula, use function_score.
Score with term statistics from every shard ?search_type=dfs_query_then_fetch It adds a round trip. Use it on small indices.
Trap Each shard scores with its own term statistics by default. On small indices, scores can differ by shard.
Autocomplete Suggest completions as the user types "type": "completion" The completion suggester is the fastest. It matches the start of the inputs you index.
Match the start of any word "type": "edge_ngram" Index edge n-grams. A match then works as a prefix search.
Get prefix search with little setup "type": "search_as_you_type" Query it with a bool_prefix multi_match.
Trap Set search_analyzer to standard on an edge n-gram field. Otherwise Elasticsearch splits the query into n-grams too.
Vector and semantic search Store embeddings "type": "dense_vector" Set dims. Similarity is cosine by default.
Find the 10 nearest vectors "knn": {"k": 10, "num_candidates": 100} HNSW finds approximate neighbours. Raise num_candidates for accuracy.
Embed text with no pipeline of your own (8.15+) "type": "semantic_text" It calls an inference endpoint when you index.
Combine keyword and vector results Reciprocal rank fusion (RRF). It ranks by each document's place in each list.
Tip A filter inside knn runs during the search, not after it, so you still get k hits.
Aggregations group and measure the matching documents Bucket, metric and pipeline aggregations Group documents into buckets "terms": {"field": "brand"} range and date_histogram also make buckets.
Compute a value for each bucket "avg": {"field": "price"} sum, min and max work the same way.
Compute from other aggregations' results "cumulative_sum": {"buckets_path": "sales"} A pipeline aggregation, here a running total.
Break each bucket down again Nest an aggs block inside the bucket aggregation.
Trap The nested aggregation isn't a sub-aggregation. It aggregates the inner documents of a nested field.
Date histograms Bucket sales by calendar month "calendar_interval": "month" Each bucket has as many days as its month.
Bucket by a fixed span, like 12 hours "fixed_interval": "12h"
Drop empty buckets "min_doc_count": 1 extended_bounds adds empty buckets past the data.
Trap calendar_interval takes one unit, like 1d. A multiple like 2d needs fixed_interval.
Index management aliases, reindexing, templates, lifecycle and backups Aliases and reindexing Swap the index behind an alias at once POST /_aliases Send a remove and an add together. Searches never see a gap.
Show only error logs through an alias "filter": {"term": {"level": "error"}} A filtered alias.
Create a new index with the fixed mapping PUT /products_v2 Reindex copies no settings or mappings.
Copy the documents across POST /_reindex?wait_for_completion=false It runs as a task. Then swap the alias.
Delete the old index DELETE /products_v1
Rename a field without reindexing "type": "alias" A field alias.
Tip Aliases also give many monthly indices one name, and keep old names working for old clients.
Trap Writes during the copy need a plan. A second pass with op_type: create adds missed documents, but not updates or deletes.
Index templates Give every new logs-* index the same settings PUT /_index_template/logs Set index_patterns, then put settings, mappings and aliases under template.
Reuse blocks across templates PUT /_component_template/base List them in composed_of.
Decide which template wins "priority": 600 The higher one wins. Built-in ones use 100.
Trap PUT /_template makes a legacy template, deprecated since 7.8. Use _index_template.
Lifecycle and data tiers Name the ILM phases Hot, warm, cold, frozen and delete. An index enters each at its min_age.
Start a new index at 50GB a shard or 30 days "max_primary_shard_size": "50GB" "max_age": "30d" The rollover action, in the hot phase.
Delete indices a year after rollover "min_age": "365d" Set it on the delete phase.
Put a node in the hot tier node.roles: [ data_hot ] Or data_warm, data_cold, data_frozen. ILM moves older indices down the tiers.
Tip Cold and frozen tiers can use searchable snapshots, which need no replicas. Frozen reads them straight from the repository.
Snapshots and restore Register where snapshots go PUT /_snapshot/my_backup A shared filesystem, S3, Azure Blob Storage or Google Cloud Storage.
Take a snapshot PUT /_snapshot/my_backup/snap-1 Each one is incremental, so frequent snapshots stay cheap.
Restore under new names POST /_snapshot/my_backup/snap-1/_restore Set rename_pattern if the names clash with live indices.
Take snapshots on a schedule PUT /_slm/policy/nightly Snapshot lifecycle management (SLM).
Trap Copying the data folders is not a backup. Snapshots are the only supported way.
Monitor, secure & tune keep a production cluster healthy and fast Monitor a cluster Check cluster health GET /_cluster/health Yellow means a replica is unassigned. Red means a primary is.
List indices or nodes as a table GET /_cat/indices?v GET /_cat/nodes?v
Find out why a shard is unassigned GET /_cluster/allocation/explain
Check heap, GC and thread pools GET /_nodes/stats
Tip Alert on heap above 85%, disk above 85%, slow searches and failed indexing.
Trap At 85% disk, Elasticsearch puts no new shards on a node. At 95%, it blocks writes to that node's indices.
Secure a cluster Turn security on It's on by default since 8.0. Before that, set xpack.security.enabled: true .
Encrypt node and client traffic xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.enabled: true
Give an app its own credentials POST /_security/api_key
Create a role that reads logs-* POST /_security/role/logs_reader A role can also hide fields and filter documents.
Tip Turn on audit logging. Encrypt the disks too, since Elasticsearch doesn't encrypt data at rest.
Trap Never expose port 9200 to the internet. Keep the cluster on a private network behind a firewall.
Tune indexing and search Load a large data set fast "number_of_replicas": 0 Turn refresh off too. Until you add replicas back, a node failure can lose data.
Speed up writes, at a risk "translog.durability": "async" A crash can lose acknowledged writes.
Search one shard instead of all ?routing=user42 Index the documents with the same value.
Keep the heap out of swap bootstrap.memory_lock: true Leave the heap size to Elasticsearch, or keep it under 32GB.
Tip Index and search tuning often conflict. Replicas raise search throughput but slow every write.
Debug a slow search Log searches slower than 2 seconds "index.search.slowlog.threshold.query.warn": "2s" The slow log is off by default.
Time each part of a query, per shard "profile": true It adds overhead, so compare parts, not totals.
See what busy nodes are doing GET /_nodes/hot_threads
Find words that end in ing {"wildcard": {"name": "*ing"}} A leading wildcard reads every term. Index n-grams instead.
Tip Scripts in sorts or script_score run for every document. Compute those values at index time.
Nothing matches. Try a shorter word, or clear the search.
Practice 49 interview questions Full answers, from beginner to expert.
Found this useful? Pass it on.
Share on LinkedIn
Share on X
Copy link
This sheet stays free. With Pro , you can:
Every answer on this sheet. Read the full answer to all 49 questions it links, not just the 5 free ones.My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.
