Explore topic-wise InterviewSolutions in .

Elasticsearch provides near real-time search functionality. It MEANS that there is a slight DELAY (approximately one second) between the time you index a DOCUMENT and the moment it becomes SEARCHABLE.

Types are logical categories or parts of an index whose semantics are determined by the user. Elasticsearch clusters can consist of multiple Indices (databases), each of which contains several Types (tables). A TYPE HOLDS multiple Documents (rows), and every document has some Properties (COLUMNS). By using types, multiple DATA types can be stored in the same index, thus reducing the total number of indices.

Example:

Suppose, in your CAR manufacturing scenario, you had a Tatafactory index. There are three types (tables) in this index as follows:

• Cars
• People
• Spare_Parts

Every type then contains documents relevant to that type (e.g. a Tata Innova document is housed in the Cars type). In this document, you can find all the information about the particular car.

Elasticsearch lets you add the mapping to an index BASED on the DATA provided by the USER in the REQUEST body. The following syntax can be used to add a mapping to an index:

Syntax:

Deleting an index removes all of its shards, DOCUMENTS, and metadata. Use the following command to delete an index in Elasticsearch:

SYNTAX:

EXAMPLE: To delete an index named my-index-321, we use the following command.

Shard: Elasticsearch crashes are often caused by LARGE indexes. Due to the unlimited number of documents that can be stored on each index, an index may consume more disk space than the hosting server can provide. Indexing will begin to FAIL as soon as the index reaches this limit. As a SOLUTION to this problem, it is possible to divide or segment indexes horizontally into MULTIPLE pieces, also called shards. For an index, you can easily specify how many shards you want. As a result, every shard is its own, fully functional, and independent "index", which can run on any node in a cluster.

Replica: As the name implies, replicas are Elasticsearch fail-safe mechanisms, and are essentially copies of an index's shards. As a backup, this could come in handy when a node crashes. Furthermore, replicas can serve read requests, which is useful for increasing search performance. To ensure HIGH availability, replicas must not be placed on the same node as the original shard (called the "primary shared") from which they were replicated.

An index is a COLLECTION of DOCUMENTS that are somewhat similar in nature. As an example, you could have an index of customer data, another ONE of product catalogs, and another one of order data. The name of an index (which must be all lowercase) serves as an identifier for the index when indexing, SEARCHING, updating, and deleting documents contained within it. An index (plural: indices) can have one or more than one shards and replicas. 

ELASTICSEARCH allows the FOLLOWING OPERATIONS to be PERFORMED over documents:

• Indexing a document
• Fetching documents
• Updating documents
• Deleting documents

The term "document" refers to a unit of information that can be indexed. Each index WITHIN Elasticsearch CONTAINS multiple documents. For instance, you could have a document for EVERY customer, another for every order, etc. These documents are written in JavaScript Object Notation (JSON), which is a widely used format for internet data exchange. Documents are composed of fields, and each field has its own TYPE of data. In a particular index, you can store as many documents as you wish.

You can think of a NODE as a SINGLE server that forms part of your cluster. Nodes are assigned roles that describe their responsibilities and operations. By default, EVERY cluster node can handle HTTP and transport TRAFFIC. Communication between nodes is CARRIED out via the transport layer, while REST clients utilize the HTTP layer. Nodes in a cluster are aware of each other and can forward client requests to the right node.

A cluster is a COLLECTION of connected nodes. If you run only one instance or node of Elasticsearch, then you have a single-node cluster or a cluster of one node. CLUSTERS automatically REORGANIZE themselves when nodes join or leave so the data is DISTRIBUTED evenly among all the nodes. Despite being fully functional, the cluster is at risk of data LOSS if it fails.

With fuzzy search, you can FIND DOCUMENTS with terms similar to your search term based on a Levenshtein edit distance measure. Edit distance is essentially the number of single-character changes or edits required to change one term into another. Among these changes are:

• Change one character (box → fox)
• Remove one character (black → lack)
• Insert one character (sic → sick)
• Transpose two adjacent characters (act → cat)

Within a SPECIFIC edit distance, the fuzzy query generates a list of all POSSIBLE variations and expansions of the search term. After that, the query returns a list of all possible matches. The most relevant and exact matches APPEAR near the top of the list.

ElasticSearch mappings define how documents and their FIELDS are indexed and stored in ElasticSearch databases or ElasticSearch DBs. This DEFINES the types and formats of the fields that appear in the documents. As a result, MAPPING can have a significant impact on how Elasticsearch searches for and stores data. After creating an index, we MUST define the mapping. An incorrect preliminary definition and mapping might lead to incorrect search results.

Types of mapping

• Static mapping: Users perform static mappings when they create an index. We use static mappings to define data types and indexes. It is easy to define fields and their types when creating an index.
• Dynamic mapping: Elasticsearch automatically creates dynamic mappings for the tables. The dynamic mapping of Elasticsearch comes in handy when we need to store extra attributes on documents. It is not always necessary to configure field names and types when indexing documents, as these will be created automatically by Elasticsearch based on any predefined rules.

To shut down or turn off the Elasticsearch service on a Linux server, you will need to 'KILL' the running process. It is accomplished by sending a SIGTERM REQUEST to the process, which ends or terminates it.

In order to initiate the shutdown process, you must first determine the process identifier (PID) for the Elasticsearch service you wish to terminate. GREP command can be USED to locate PROCESSES easily. If you wish to locate all Elasticsearch-related processes running on a server, you can use the following command:

After identifying the correct PID, simply execute a kill command with the PID of the Elasticsearch process. Upon successful execution of the kill command, Elasticsearch should no longer be running. 

Field types (also CALLED field data types) describe the type of information or data a field contains, such as a string or boolean, and its intended use. The following are some data types for document fields:

Common data types:

• Binary: A binary value that is encoded as a BASE64 string.
• Boolean: A true or false value.
• Keywords: The keyword family, which includes the keyword, constant keyword, and wildcard.
• Numbers: Numeric types such as long, double, float, bytes, integer, etc.
• Dates: Date types, such as date_nano, date.
• Alias: Represents the alias of an existing field.

Objects and relational types:

• Object: Represent a JSON object.
• Nested: A JSON object that maintains a relationship between its subfields.
• Flattened: An entire JSON object represented by a single field value.\
• Join: Establishes a parent/child relationship between documents WITHIN an index.

Structured and Spatial data types:

• Range: Range types, like date_range, long_range, float_range, double_range, and IP_range.
• Point: Arbitrary cartesian points.
• Geo_point: Longitude and latitude points
• Shape: Arbitrary cartesian geometries.
• Geo_shape: COMPLEX shapes like POLYGONS.

The Working of ElasticSearch is summarized as follows:

• Firstly, raw data is GATHERED from a variety of sources, such as log files, SYSTEM METRICS, or web applications. Beats are lightweight data shipping agents (data shippers) that collect different types of data and forward it to LOGSTASH.
• This raw data is normalized, analyzed, and enriched prior to being indexed in Elasticsearch. Logstash performs several transformations and enhancements, and then sends the data to be indexed in Elasticsearch.
• As SOON as the data has been indexed in Elasticsearch, then users can run queries against it, and then aggregate it to generate insights. ElasticSearch enables you to store, search, and analyze vast or huge amounts of data in near real-time, providing results in milliseconds.
• Lastly, from Kibana, users can create powerful visualizations of data, and visualize complex queries through interactive diagrams, geospatial data, and graphs.

Elasticsearch's speed and scalability as well as its ability to index different TYPES of data make it ideal for a number of use cases. In addition to its high scalability, Elasticsearch also offers near-real-time search capabilities. All this adds up to a solution that offers much more than a search engine and supports many operational and critical business use cases. Since Elasticsearch has powerful search capabilities, it is typically the underlying TECHNOLOGY for APPLICATIONS requiring complex search requirements. Listed below are some of the use cases of ElasticSearch:

• Application search, Enterprise search, and Website search.
• Analyzing log data in near-real-time and on a scalable basis.
• Business analytics and security analytics.
• Analysis and visualization of geospatial data.
• Monitoring the PERFORMANCE of applications.
• Monitoring infrastructure metrics and containers.

ElasticSearch's advantages can be listed or summarized as FOLLOWS:

• Elasticsearch is a fast search engine: Since Elasticsearch is built on top of Apache Lucene, it provides a full-text search. The latency between the time a document is indexed and the MOMENT it can be searched is extremely short with ElasticSearch - typically one second. This makes Elasticsearch a good choice for time-sensitive use cases such as infrastructure monitoring and security analytics.
• Elasticsearch is a distributed search engine: Elasticsearch stores or distributes documents across several containers called shards, which are duplicated to provide redundant copies of the data in the event of a hardware or system failure. Due to Elasticsearch's distributed nature, it can SCALE up to thousands of servers and can handle petabytes of data. You can use ElasticSearch as a replacement for document stores such as RavenDB and MongoDB.
• Elasticsearch provides a wide range of features:  Aside from being scalable, fast, and resilient, Elasticsearch OFFERS numerous built-in features like data roll-ups and index lifecycle management that make storing and searching data easier and more efficient.
• Data ingestion, visualization, and reporting are simplified with the Elastic Stack or BELEK: Data can be collected and processed easily using Beats and Logstash before being indexed in Elasticsearch. Besides providing real-time visualization of Elasticsearch data, Kibana provides UIs for QUICK access to log files, application performance monitoring (APM), and infrastructure metrics data.