Skip to content

What is Elasticsearch?

Elasticsearch is a distributed search engine based on Apache Lucene. It is a popular search engine for full-text searches or log analysis and is therefore used by many large companies such as Netflix, Slack, and Uber.

How does Elasticsearch work?

This search engine is based on the fact that the raw data and documents that are to be searched are combined in an index. For this purpose, they are normalized and parsed in the indexing step so that the final search can run faster. This pre-processed index can be searched much faster than the original documents and data.

Let’s assume we have an online store with various pieces of furniture, which we want to make accessible to our customers with the help of a search. For each piece of furniture, there is information that should be considered in the search. This includes, among other things, the product properties (e.g. the dimensions, color, or special features) and the product description. To ensure that these textual properties can be searched quickly, we use the full-text search Elasticsearch.

To do this, we have to store the data and documents in its index. This can be thought of as a database in which all information is stored. In the index, there are several so-called types, which are comparable with tables in a database.

In our example, only the product properties could be stored in one type, while the product descriptions are stored in a second type. In the types, there are then finally still the documents in which individual data records are held. Although the index is not a strict relational database, a certain structure must still be maintained so that a quick search is possible.

In our example, the individual pieces of furniture are prepared in the documents and stored in a structure so that they are easier to find for the final search. For this purpose, the so-called attributes are defined within the documents, which come closest to the columns in a table.

What do you use Elasticsearch for?

Elasticsearch can be used wherever search functionality is needed. Additionally, it stands out for its high scalability and fast search process. A number of applications for which it can be considered are:

  • Search on websites
  • Search engines in applications
  • Search engine for corporate data
  • Searching log files
  • Search in geodata
  • Search in security and monitoring files

What are the Components of Elasticsearch?

Because of its widespread use and many benefits, a whole stack of tools has formed around Elasticsearch that goes beyond just search.

With the help of Logstash, data can be collected and prepared so that it is better suited for subsequent indexing. The open-source program can be understood as Elastic’s ETL tool and offers comparable functionalities by pulling together data from different sources, transforming it, and bringing it to the final storage location.

Components of Elasticsearch | Quelle: Michael Wutzke

The tool that is downstream of Elastic’s search is Kibana. It offers the possibility to visualize and analyze the information from the search index. This so-called ELK (Elastic, Logstash, Kibana) stack thus offers the possibility to cover the complete range from obtaining the data, through a search, to the analysis of the index.

What are the benefits of Elasticsearch?

Elasticsearch is a very popular search engine nowadays due to its many advantages. Some of them are:

  • Speed: Due to the indexing, it is significantly faster than comparable algorithms, especially in full-text search. In addition, preparatory indexing does not take very long either, which means that the overall process from inclusion in the index to findability in the search is very fast. This is very advantageous for applications where the speed of the search is an important criterion.
  • Distributed Architecture: The index is distributed across different physical machines, called shards. Copies of individual documents are also created to compensate for the failure of a single machine. This cluster structure allows the performance of the search to be scaled.
  • Other Functionalities: Elasticsearch also offers many other functions that help to ensure that search performance is very high. These include, for example, data rollups or index lifecycle management.
  • Business Analytics: The components already described offer, among other things, the possibility to visualize and process the index or the processed data. This offers a holistic approach.

What Advantages does Elasticsearch offer over other Search Engines?

The first factor is that Elasticsearch is open source and can therefore be implemented completely free of charge. Costs may be incurred if external help is needed for the implementation. Other search engine providers, including Google, offer free versions of their search engines, but these then often contain advertising, which can only be canceled by a paid version.

A second important point is that the composition of the index is very flexible and you can freely determine which elements are to be found in the full-text search and which are not. This is also a unique selling point compared to other search providers.

Finally, the ELK stack also offers the possibility of being able to view the search holistically, from the collection of data, through the processing, to the finished search. This component, too, is rather sought in vain in other search engines and therefore explains the spread of Elasticsearch.

What are the Disadvantages of Elasticsearch?

Despite the immense benefits of Elastic’s search algorithm, there are also some issues that should be considered and weighed before implementation:

  • Search is not compatible with all store systems and infrastructures.
  • With self-hosted servers, implementing Elasticsearch can become very costly and complicated.
  • The distribution of the index over an entire cluster offers advantages in terms of scaling, but can also quickly become a disadvantage. This is the case if too many so-called primary shards are used and the index is thus distributed over many machines. As a result, all of these machines must become active when a new document is indexed, which leads to a high load on the system just for indexing.

This is what you should take with you

  • Elasticsearch is a popular full-text search for various applications.
  • The basic principle is to index the data and thus make it easier and faster for the search algorithm to find.
  • This search algorithm is characterized, among other things, by the speed of the process and by the fact that the index can be divided into a computer cluster and is therefore scalable.

Other Articles on the Topic of Elasticsearch

Much of the information from this article comes from the following sources:

Das Logo zeigt einen weißen Hintergrund den Namen "Data Basecamp" mit blauer Schrift. Im rechten unteren Eck wird eine Bergsilhouette in Blau gezeigt.

Don't miss new articles!

We do not send spam! Read everything in our Privacy Policy.

Cookie Consent with Real Cookie Banner