Page 3 - Elasticsearch

A snapshot only becomes a real backup strategy once the repository is set up correctly, the snapshot frequency is automated through an SLM policy, and the restore path is tested regularly. This article shows how snapshot repositories on S3 and filesystem work, how incremental snapshots save storage, and how a restore actually plays out in practice without endangering the production cluster.

The date histogram aggregation groups documents into fixed time buckets and is the foundation of almost every time series analysis in Elasticsearch and OpenSearch. Confuse calendar_interval with fixed_interval or ignore timezones, and you get dashboards with shifted bars and wrong day boundaries, without the query ever throwing an error.

An array of objects looks harmless in JSON, but is stored completely differently internally depending on the chosen field type. The default type object flattens the structure and loses the association between fields across different array entries, leading to hits that should never have matched. Nested preserves exactly that relationship, at the cost of more resources.

Autocomplete is not a simple prefix search, it is its own discipline with three different implementation approaches in Elasticsearch that differ substantially in latency, storage cost and flexibility. Anyone who understands the Completion Suggester, the Edge N-Gram approach and search_as_you_type can pick the right solution for each use case, instead of forcing a one-size-fits-all implementation.

Fuzzy search catches typos by allowing words that are similar to, but not identical with, the search term. The fuzziness parameter controls, through the Levenshtein distance, how many character changes are tolerated. Anyone who calibrates this parameter incorrectly ends up with either too many irrelevant hits or misses exactly the typos it was meant to catch.

Dynamic mapping saves a lot of configuration effort at the start, but with unpredictable input data it can quietly generate thousands of fields and bring a cluster to its knees. Teams that deploy dynamic false, dynamic strict and dynamic templates deliberately keep automatic field detection under control without giving up its benefits.

An unsecured Elasticsearch or OpenSearch cluster is directly attackable over the network without authentication and encryption. This article shows how role-based access control, API keys and TLS between nodes work together, and what to watch for specifically when configuring Elastic Security and OpenSearch Security.

On catalogs with several hundred thousand SKUs, the catalogsearch_fulltext indexer quickly becomes an operational bottleneck: full reindex runs take hours, the cron job blocks other jobs, and PHP workers hit their memory limits. This article shows how batch size, partial reindex strategies and the Elasticsearch Bulk API work together to noticeably improve indexer performance on large catalogs.

Pipeline aggregations do not run over individual documents, they run over the results of other aggregations. That lets trends, moving averages and cumulative sums be computed directly in the query, instead of rebuilding them in application code where they are error-prone. Confuse sibling and parent pipelines, and you get aggregation errors or incorrectly nested results.

When an Elasticsearch or OpenSearch cluster suddenly slows down, aimless trial and error rarely helps. This checklist combines slow log, hot threads API, pending tasks and queue rejections into a systematic diagnostic path that finds the actual cause of a performance problem instead of just treating symptoms.