Elasticsearch Tutorials

Elasticsearch from a first document to a search feature you can put in front of users — mappings and analysis, the query DSL, filtering, relevance, aggregations, geo search, keeping an index in step with a database, aliases and zero-downtime reindexing, snapshots and production hardening. Every example is taken from a real short-let booking app, and every query in it has been run against the cluster it describes.

• Elasticsearch – What to Do Before You Go to Production
  The list, in the order it bites. Shard sizing and why more shards is usually the wrong instinct, replicas and what green actually promises, JVM heap and the 50% rule, security beyond turning it on — an API key scoped to one index rather than the elastic superuser every guide leaves you using — index lifecycle management, what to monitor, and the failure modes to rehearse before they happen.
• Elasticsearch – Snapshots, Restores and SLM
  Registering a repository, taking a snapshot, restoring it, and automating the whole thing with a lifecycle policy — plus the retention setting that stops a cluster which was off for a month from deleting every backup it has the moment it comes back. And an honest answer to the question underneath: if your index is derived from a database, a rebuild may be the better restore, and knowing which is the point.
• Elasticsearch – The _cat APIs and Reading Cluster Health
  The APIs you actually type when something is wrong. _cat/health, indices, nodes, shards and allocation, with the v, h and s parameters that make them readable. Then the questions they answer: what yellow really means and why a single-node cluster is yellow by default, which shard is unassigned and why, where the disk went, and how to tell a slow query from a slow cluster.
• Elasticsearch – Aliases and Zero-Downtime Reindexing
  A field type cannot be changed once it has been written, so sooner or later you have to move every document into a new index. Whether that is an outage depends on one decision you make on day one: never let your application name a concrete index. Aliases, _reindex, the atomic alias swap, what happens to writes that land during the copy, and how to migrate a cluster that already got this wrong.
• Elasticsearch – Geo Queries and geo_point
  “Show me places near here”, done properly. Mapping geo_point and the five formats it accepts — including the one that reverses longitude and latitude and silently puts your listings in the Gulf of Guinea. geo_distance as a filter, geo_bounding_box for a map viewport, sorting by _geo_distance and reading the distance back off each hit for free, and geo_shape when a point is not enough.
• Elasticsearch – Aggregations and Faceted Search
  Aggregations are the other half of Elasticsearch, and the half that turns a search box into a filter panel. Metric, bucket and pipeline aggregations, nesting them, aggregating on keyword rather than text and why that is not optional, and the part most tutorials skip: a facet counted inside its own filter collapses to a single row, so the guest can never switch cities without clearing the filter first.
• Elasticsearch – Sorting Results
  Sorting looks trivial until the first field you try refuses. Why sorting on a text field fails and what fielddata has to do with it, tie-breakers and why a sort without one gives unstable pages, missing values, sorting by distance and by script, what happens to _score when you sort by a field, and reading the sort values back off a hit — which is also how search_after paginates past the 10,000-result wall.
• Elasticsearch – Relevance Tuning That Is Not Guesswork
  A relevance complaint is never settled by opinion. What BM25 actually computes, reading the _explain output that shows the arithmetic, what a field boost is worth and why ^2 shows up as 4.4, the multi_match types and a real bug one of them caused — “san francisco loft” returning nothing — fuzziness, and folding a rating into a text score with function_score without letting it take over.
• Elasticsearch – bool, Filters and the Filter Cache
  How real queries are assembled. The four bool clauses — must, filter, should, must_not — and the distinction that decides both correctness and speed: filter clauses do not score and are cached, must clauses score and never can be. Then term versus terms when a filter panel has two boxes ticked, ranges, exists, and why a filter on a text field quietly matches the wrong things.
• Elasticsearch – The Search API and Query DSL
  The read side, in the order you need it. The anatomy of a response, match versus term and the single most common beginner bug hiding in that difference, multi_match across fields, _source filtering, pagination and the 10,000-result wall that from + size hits, track_total_hits, and highlighting — including the setting that stops a highlighted fragment from being an XSS hole.
• Elasticsearch – Bulk Indexing and Keeping It in Sync
  Indexing 200 documents one call at a time took 526ms; the same 200 in one bulk request took 47ms. The bulk API, its partial-failure model — a 200 response that contains failures — and helpers.bulk. Then the harder half: how a Postgres row and a search document stay in step. Index after the commit and never before, why a failed index must not fail the write, and the outbox that retries it.
• Elasticsearch – Indexing, Updating and Deleting Documents
  The write side. Index, get, update and delete, why choosing your own document id is what makes indexing idempotent, and what near-real-time actually means — the reason a test that indexes and immediately searches finds nothing and looks like a broken query. Then refresh and what it costs, and optimistic concurrency with seq_no and primary_term for the case where two writers race.
• Elasticsearch – Modelling Your Data for Search
  The hardest habit to break coming from SQL: stop normalising. One document per thing a user searches for, denormalised on purpose, because a join at query time is exactly the work the index exists to avoid. When nested is worth its cost, why parent/join is almost always the wrong answer, index-per-tenant versus a filter, and how to decide what belongs in the document at all.
• Elasticsearch – Analyzers and Text Analysis
  Almost every “why does my search return nothing?” is one bug: the analyzer that ran when the document was indexed and the analyzer that ran on the query disagreed, so the terms never matched. What an analyzer is made of, the _analyze API that shows you the tokens instead of making you guess, building a custom one, and the two classic traps — keyword fields are not analysed at all, and changing an analyzer does nothing to documents already indexed.
• Elasticsearch – The Field Types That Matter
  Not a catalogue. The eight or so types a real project actually needs and the decisions behind them: text versus keyword and why that one distinction causes most beginner confusion, scaled_float for money, date and what it accepts, boolean, geo_point, and object versus nested — including the array-flattening behaviour that makes nested necessary and is invisible until it returns a wrong result.
• Elasticsearch – Mappings, and Why You Should Write Your Own
  Dynamic mapping guesses a field's type from the first document it sees, and it guesses from ONE document. A price that happens to arrive as 120 becomes a long and the next listing at 119.50 is a problem. Writing an explicit mapping, what dynamic: strict buys, multi-fields, and the constraint that shapes everything afterwards: a field's type cannot be changed once it has been written.
• Elasticsearch – Installation and First Connection
  Getting 8.x running and talking to it, including the part that changed and breaks every older tutorial: security is on by default, so the plain docker run you were given in 2020 now answers 401. Docker Compose with sensible settings, what the enrollment token and elastic password are for, checking cluster health, and connecting the Python client with a timeout that will not take your API down.
• What is Elasticsearch, and When Should You Use One?
  Start here. What an inverted index actually does that a database index cannot, the queries that justify running a second datastore, and the ones that do not. The vocabulary you need before anything else makes sense — cluster, node, index, shard, replica, document — and the single most important consequence of the whole design: the index is a derived copy, and treating it as the source of truth is the mistake every other lesson in this track is arranged to prevent.