Elasticsearch Expert

Expert guidance for Elasticsearch, search optimization, ELK stack, and distributed search systems.

Core Concepts

• Full-text search and inverted indexes

• Document-oriented storage

• RESTful API

• Distributed architecture with sharding

• ELK stack (Elasticsearch, Logstash, Kibana)

• Aggregations and analytics

Index Management

from elasticsearch import Elasticsearch

es = Elasticsearch(['http://localhost:9200'])

Create index with mapping

mapping = { "mappings": { "properties": { "title": {"type": "text", "analyzer": "english"}, "content": {"type": "text"}, "author": {"type": "keyword"}, "created_at": {"type": "date"}, "views": {"type": "integer"} } } }

es.indices.create(index='articles', body=mapping)

Index document

doc = { "title": "Elasticsearch Guide", "content": "Complete guide to Elasticsearch", "author": "John Doe", "created_at": "2024-01-01", "views": 100 }

es.index(index='articles', id=1, body=doc)

Bulk indexing

from elasticsearch.helpers import bulk

actions = [ {"_index": "articles", "_id": i, "_source": doc} for i, doc in enumerate(documents) ]

bulk(es, actions)

Search Queries

Full-text search

query = { "query": { "match": { "content": "elasticsearch guide" } } }

results = es.search(index='articles', body=query)

Boolean query

bool_query = { "query": { "bool": { "must": [ {"match": {"content": "elasticsearch"}} ], "filter": [ {"range": {"views": {"gte": 100}}} ], "should": [ {"term": {"author": "john-doe"}} ], "must_not": [ {"term": {"status": "draft"}} ] } } }

Multi-match query

multi_match = { "query": { "multi_match": { "query": "elasticsearch guide", "fields": ["title^2", "content"], # Boost title "type": "best_fields" } } }

Fuzzy search

fuzzy = { "query": { "fuzzy": { "title": { "value": "elasticseerch", "fuzziness": "AUTO" } } } }

Aggregations

Aggregation query

agg_query = { "aggs": { "authors": { "terms": { "field": "author", "size": 10 } }, "avg_views": { "avg": { "field": "views" } }, "views_histogram": { "histogram": { "field": "views", "interval": 100 } }, "date_histogram": { "date_histogram": { "field": "created_at", "calendar_interval": "month" } } } }

result = es.search(index='articles', body=agg_query)

Best Practices

• Design mappings carefully

• Use appropriate analyzers

• Implement proper sharding strategy

• Monitor cluster health

• Use bulk operations

• Implement pagination with search_after

• Cache frequently used queries

Anti-Patterns

❌ Deep pagination with from/size ❌ Wildcard queries without prefix ❌ No replica shards ❌ Over-sharding ❌ Not using filters for exact matches ❌ Ignoring cluster yellow/red status

Resources

• Elasticsearch Guide: https://www.elastic.co/guide/

• ELK Stack: https://www.elastic.co/elk-stack