Elasticsearch Do's, Don'ts and Pro-Tips
summary
Ransomware is wiping publicly reachable Elasticsearch clusters — about ~5,000 exposed clusters are known — so lock down network.host, disable HTTP on master/data nodes, put Kibana behind VPN or auth, and disable dynamic scripting on versions <5. Use the snapshot API and schedule snapshot every 5–10 minutes for cheap recovery; use reindex/shrink/rollover APIs in ES5 for maintenance. Aim for shard sizes near 1M docs / 5–10GB, run exactly three master-eligible nodes, avoid deep paging and use search_after or scroll.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:19Agenda
- 4:55Protecting your cluster
- 11:18Index Management Patterns
- 17:32Elasticsearch 2 x 5.0
- 18:30Document oriented design
- 25:50Document-oriented design
- 27:15Query-based design
- 28:10Console
- 28:52Query latency
- 31:56Design for efficient queries
- 34:18Deep paging
- 42:05Don't use NGrams for search
- 44:55Query explanation
- 46:44Named queries
- 47:25Mappings
- 50:03Do you really need types?
- 51:48Cluster management
- 53:34Re-balancing is your enemy
- 55:06Optimal shard size
- 56:30Debugging tools
- 57:31Cluster topology
- 59:36Geographic distribution
related talks
16mTop Elasticsearch tips
40mMaking your elastic cluster perform
44mElasticsearch at Scale of Billions of Documents
58mTroubleshooting your Elasticsearch cluster like a Support Engineer
54mScale Your Elasticsearch Cluster
29mHow (not) to Scale Elasticsearch for Data Analytics!
44mSurviving Elasticsearch
01h 01mBest Practices With Elasticsearch