Concepts on Advanced Beginner

Core Components

d8lzz1gpw@mozmail.com (kimbenji) — Sat, 10 Jan 2026 00:00:00 +0000

TL;DR

Cluster: A group of servers providing high availability and distributed processing

Node: A single Elasticsearch server in the cluster (Master, Data, Coordinating roles)

Index: A logical collection of documents (similar to RDB table)

Document: A JSON data unit (similar to RDB row)

Shard: A horizontal partition of an index (consists of Primary/Replica)

Target Audience: Developers new to Elasticsearch Prerequisites: JSON basics, REST API concepts

Understand the roles and relationships of Elasticsearch’s core components: Cluster, Node, Index, Document, and Shard.

Data Modeling

d8lzz1gpw@mozmail.com (kimbenji) — Sat, 10 Jan 2026 00:00:00 +0000

TL;DR

Mapping: Schema defining document structure (similar to RDB table definitions)

text: For full-text search, tokenized by Analyzer

keyword: For exact value matching, sorting/aggregation

Analyzer: Converts text into searchable tokens (use Nori for Korean)

Denormalization: Include related data in one document since there’s no JOIN

Target Audience: Developers looking to use Elasticsearch search features Prerequisites: Core Components, basic JSON syntax

This document covers Mapping, Field Type, and Analyzer design for effectively storing and searching data in Elasticsearch.

Query DSL

d8lzz1gpw@mozmail.com (kimbenji) — Sat, 10 Jan 2026 00:00:00 +0000

TL;DR

Query Context: Full-text search that calculates relevance score

Filter Context: Only checks conditions without score, cached for speed

match/match_phrase: Used for full-text search (text fields)

term/terms/range: Used for exact value search (keyword fields)

bool: Combines queries with must/should/must_not/filter

Target Audience: Developers who understand Elasticsearch basics Prerequisites: Core Components, JSON basics

Learn how to write various search queries using Elasticsearch’s Query DSL (Domain Specific Language).

Basic Query Structure#

GET /products/_search
{
 "query": {
 // Search conditions
 },
 "from": 0, // Pagination offset
 "size": 10, // Number of documents to return
 "sort": [ // Sorting
 { "price": "asc" }
 ],
 "_source": ["name", "price"] // Fields to return
}

Query Context vs Filter Context#

Elasticsearch queries execute in two contexts.

Search Relevance

d8lzz1gpw@mozmail.com (kimbenji) — Thu, 08 Jan 2026 00:00:00 +0000

Prerequisites
Before reading this document, understand these concepts first:

Query DSL - match, bool query basics

Data Modeling - Analyzer operation principles

Learn relevance tuning methods including Score, BM25, and Boosting to improve search result quality.

The core value of a search engine is enabling users to find what they want on the first page. No matter how quickly results are returned, if what users want is on page 10, it’s meaningless. Search Relevance is the key concept for solving this problem.

Aggregations

d8lzz1gpw@mozmail.com (kimbenji) — Thu, 08 Jan 2026 00:00:00 +0000

Prerequisites
Before reading this document, understand these concepts first:

Query DSL - Basic query structure

Data Modeling - keyword vs text types

Learn how to analyze data and extract statistics using Elasticsearch Aggregations.

While Elasticsearch is a search engine, it’s also a powerful real-time analytics engine. When you search for “laptop” on an e-commerce site, the brand filters, price range filters, and rating distributions that appear on the left side are all results of Aggregations. Implementing these features with RDBMS would require complex subqueries and GROUP BY combinations, and performance issues would be severe with large datasets.

Indexing Strategy

d8lzz1gpw@mozmail.com (kimbenji) — Thu, 08 Jan 2026 00:00:00 +0000

Prerequisites
Before reading this document, understand these concepts first:

Core Components - Shard, Segment concepts

Data Modeling - Mapping, Analyzer basics

Learn Bulk indexing, Refresh, and Index Lifecycle Management for efficiently storing large volumes of data.

Elasticsearch indexing goes beyond simply storing data. When a document is indexed, it goes through a complex process including text analysis, inverted index creation, and segment management. Understanding this process reveals why Bulk indexing is 10x faster than single-document indexing, why documents aren’t immediately searchable after indexing, and why Refresh should be disabled during bulk indexing. The right indexing strategy directly impacts system performance and operational costs.

Cluster Management

d8lzz1gpw@mozmail.com (kimbenji) — Thu, 08 Jan 2026 00:00:00 +0000

Learn how to configure nodes, allocate shards, and monitor status in an Elasticsearch cluster.

Elasticsearch was designed from the ground up as a distributed system. Even when starting with a single node, it operates internally as a cluster. Thanks to this distributed architecture, you can scale horizontally by simply adding nodes as data grows, and the service can continue even when some nodes experience failures.

However, distributed systems introduce different complexities than single servers. You need to understand role distribution among nodes, physical shard placement, master election processes, and behavior during network partitions to operate stably. In particular, incorrect Master node configuration can bring down the entire cluster, and unbalanced shard placement can concentrate load on specific nodes. This document covers core concepts and practical know-how for stable cluster operation.

Performance Tuning

d8lzz1gpw@mozmail.com (kimbenji) — Thu, 08 Jan 2026 00:00:00 +0000

Learn how to optimize Elasticsearch search and indexing performance.

While Elasticsearch provides fast search with default settings, production environments require tuning based on data scale and usage patterns. Default values are “generally acceptable,” not “optimal for all situations.”

Performance tuning can be divided into four areas: Index Design, Query Optimization, Caching, and System Settings. Each area affects the others. For example, poor shard design cannot be solved by query optimization, and caching strategy depends on query patterns. Therefore, it’s effective to first identify where bottlenecks occur, then focus on improving that specific area. This document covers key tuning points and practical considerations for each area.

High Availability

d8lzz1gpw@mozmail.com (kimbenji) — Thu, 08 Jan 2026 00:00:00 +0000

Learn about Elasticsearch cluster Replica, Snapshot, and failure response strategies.

High Availability Concepts#

HA (High Availability) Goals#

Metric	Description	Target
Availability	Service uptime	99.9% (8.76 hours downtime/year)
Durability	Data loss prevention	99.999999% (9-nines)
Recovery Time	Failure to recovery	< 30 minutes

HA Components#

flowchart TB
 A[High Availability] --> B[Replica Shard]
 A --> C[Snapshot & Restore]
 A --> D[Cross-Cluster Replication]
 A --> E[Cluster Design]

Replica Shard#

Role#

flowchart LR
 subgraph Node1
 P0[Primary 0]
 end
 subgraph Node2
 R0[Replica 0]
 end
 subgraph Node3
 P1[Primary 1]
 end

 P0 -->|Replication| R0
 Client -->|Write| P0
 Client -->|Read| R0

Data Redundancy: Replica is promoted when Primary fails
Read Performance: Search requests distributed

Replica Configuration#

PUT /products
{
 "settings": {
 "number_of_shards": 3,
 "number_of_replicas": 1
 }
}

Dynamic Change#

PUT /products/_settings
{
 "number_of_replicas": 2
}

Recommended Settings#

Environment	number_of_replicas
Development	0
Small Production	1
Large/Critical Data	2

Auto-Expand Replicas#

Automatically adjust based on node count:

Vector Search (kNN)

d8lzz1gpw@mozmail.com (kimbenji) — Sat, 10 Jan 2026 00:00:00 +0000

TL;DR

Vector Search: Semantic-based search that finds similar content even with different keywords

dense_vector: Field type for storing vectors, specify similarity calculation method

kNN Query: Search method to find k nearest neighbor documents

Hybrid Search: Combine kNN + keyword search for best results

Embedding Model: Converts text/images to vectors (multilingual models recommended for Korean)

Target Audience: Developers implementing semantic search or recommendation systems Prerequisites: Core Components, Query DSL, Basic ML concepts

Learn how to implement semantic search and similar image search using Elasticsearch’s vector search (kNN).

Korean Search Optimization

d8lzz1gpw@mozmail.com (kimbenji) — Thu, 08 Jan 2026 00:00:00 +0000

Prerequisites
Before reading this document, understand these concepts first:

Data Modeling - Analyzer, text vs keyword types

Query DSL - match, multi_match queries

This document covers how to optimize Korean language search in Elasticsearch. We’ll implement the Nori analyzer, autocomplete, and initial consonant (chosung) search.

Korean has fundamentally different linguistic characteristics from English, making proper search impossible with the default English analyzer. Searching “Samsung Electronics” (삼성전자) won’t find “Samsung Electronics Inc.” (삼성전자가) or “Samsung Electronics Co.” (삼성전자를), and it can’t extract “purchase” (구매) from “purchased” (구매했습니다). When users can’t find results they expect to find, they lose trust in the search service.