What is Elasticsearch?
Distributed, RESTful search and analytics engine built on Apache Lucene.
Core Concepts
Document
json
{
"_index": "users",
"_id": "1",
"_score": 1.0,
"_source": {
"name": "John Doe",
"email": "john@example.com",
"age": 30,
"joined": "2025-01-15"
}
}Index
bash
# Create index
PUT /users
{
"mappings": {
"properties": {
"name": { "type": "text" },
"email": { "type": "keyword" },
"age": { "type": "integer" },
"joined": { "type": "date" }
}
}
}Query DSL
javascript
// Match query (full-text search)
{
"query": {
"match": {
"name": "John Doe"
}
}
}
// Term query (exact match)
{
"query": {
"term": {
"email.keyword": "john@example.com"
}
}
}
// Range query
{
"query": {
"range": {
"age": {
"gte": 18,
"lte": 65
}
}
}
}
// Bool query (combine queries)
{
"query": {
"bool": {
"must": [
{ "match": { "name": "John" } }
],
"filter": [
{ "term": { "status": "active" } }
],
"must_not": [
{ "term": { "deleted": true } }
]
}
}
}Node.js Client
javascript
import { Client } from '@elastic/elasticsearch';
const client = new Client({
node: 'http://localhost:9200'
});
// Index document
await client.index({
index: 'users',
id: '1',
document: {
name: 'John Doe',
email: 'john@example.com',
age: 30
}
});
// Search
const result = await client.search({
index: 'users',
body: {
query: {
match: {
name: 'John'
}
}
}
});
console.log(result.hits.hits);Aggregations
javascript
// Terms aggregation (group by)
{
"aggs": {
"by_status": {
"terms": {
"field": "status.keyword"
}
}
}
}
// Average aggregation
{
"aggs": {
"average_age": {
"avg": {
"field": "age"
}
}
}
}
// Date histogram
{
"aggs": {
"articles_over_time": {
"date_histogram": {
"field": "created",
"calendar_interval": "month"
}
}
}
}Full-Text Search
Text Analysis
javascript
// Custom analyzer
PUT /users
{
"settings": {
"analysis": {
"analyzer": {
"my_analyzer": {
"tokenizer": "standard",
"filter": ["lowercase", "stop", "snowball"]
}
}
}
},
"mappings": {
"properties": {
"description": {
"type": "text",
"analyzer": "my_analyzer"
}
}
}
}Highlighting
javascript
{
"query": {
"match": {
"description": "elasticsearch"
}
},
"highlight": {
"fields": {
"description": {}
}
}
}Logging (ELK Stack)
Logstash Configuration
conf
input {
file {
path => "/var/log/app.log"
start_position => "beginning"
}
}
filter {
grok {
match => {
"message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"
}
}
date {
match => ["timestamp", "ISO8601"]
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "app-logs-%{+YYYY.MM.dd}"
}
}Kibana Dashboard
- Discover: View and search logs
- Visualize: Create charts and graphs
- Dashboard: Combine visualizations
Performance Tips
- 1Refresh interval: Increase for bulk indexing
- 2Replicas: Adjust for search vs write balance
- 3Shards: Don't overshard
- 4Mapping: Use appropriate field types
- 5Filter: Use filter context (no scoring)
Scaling
bash
# Cluster health
GET /_cluster/health
# Add node
# Configure elasticsearch.yml
cluster.name: my-cluster
node.name: node-3
discovery.seed_hosts: ["node1", "node2"]Common Operations
javascript
// Bulk indexing
await client.bulk({
body: [
{ index: { _index: 'users', _id: '1' } },
{ name: 'John', age: 30 },
{ index: { _index: 'users', _id: '2' } },
{ name: 'Jane', age: 25 }
]
});
// Update document
await client.update({
index: 'users',
id: '1',
body: {
doc: { age: 31 }
}
});
// Delete document
await client.delete({
index: 'users',
id: '1'
});Search smarter with Elasticsearch!