Don't Panic — Elasticsearch Fundamentals

Elasticsearch is a distributed retrieval system for JSON documents. You put documents in, it builds an index, and later it can find the ones that match or summarize the lot. This is more useful than asking a transactional database to become a search engine after lunch, which tends to make lunch unnecessarily exciting.

The first three nouns do most of the work. A document is the JSON record. An index is the named collection holding those records. A mapping tells Elasticsearch what each field means. That last one is the sneaky part: a field is not merely a label on a box. Its mapping determines whether the value can support text search, exact filtering, sorting, or aggregation. The machine is being literal because it has a great many documents to be literal about.

The index is divided into shards, pieces that can live on different nodes. Replica shards copy primary shards so search work and failures do not have to rest on one copy. That explains why Elasticsearch can spread retrieval and analytics across a cluster. It also explains why replicas are not backups. A copy inside the same system is helpful during a failure; a snapshot is what gives you a recovery plan when the system itself has made a poor life choice.

Search and analytics are related but not interchangeable. A search asks which documents match and returns hits, often with relevance scores. A filter applies firm conditions, such as a category or time range. An aggregation asks what the matching documents show: counts, groups, or metrics. If a dashboard needs a number, returning a heroic parade of documents is usually not the point.

One surprise awaits every impatient newcomer. Elasticsearch is near real time. An indexing request can succeed before a subsequent search sees the document. That is normal behavior, not a small rebellion by the data. Build user-facing expectations around it.

Read the intro when you need the architecture and the Elastic Stack context. Use the slides to keep the relationships between documents, mappings, shards, searches, and aggregations straight. Keep the cheatsheet nearby for the operational vocabulary, then use the practice reference and exercise to make the requests real. The quiz is for checking the mental model before cluster sizing, security, and recovery add their usual collection of consequences.

Don't Panic — Elasticsearch Fundamentals

Relevant careers