Elasticsearch Basics
- Elasticsearch stores JSON documents in indices — no fixed schema required.
- Full-text search is Elasticsearch's core strength: tokenisation, stemming, relevance scoring.
- match queries do full-text search; term queries do exact matching (case-sensitive).
Elasticsearch is a distributed search and analytics engine built on Apache Lucene. Data is stored as JSON documents in indices. It excels at full-text search, log analytics, and real-time aggregations. The REST API makes indexing and searching straightforward. It is not a replacement for a relational database — it lacks transactions and ACID guarantees.
Documents and Indices
An index is like a database table. Documents are JSON objects. The mapping defines the schema (field types). Unlike SQL, the schema can be dynamic.
# Index a document (HTTP PUT/POST to the REST API) PUT /articles/_doc/1 { "title": "Understanding Big O Notation", "content": "Big O describes the rate of growth of an algorithm...", "author": "Alice Chen", "published": "2025-03-17", "tags": ["algorithms", "computer science", "performance"] } # Response: # { "_index": "articles", "_id": "1", "result": "created" } # Get document by ID GET /articles/_doc/1 # Delete document DELETE /articles/_doc/1 # Bulk indexing (much faster than individual requests) POST /_bulk { "index": { "_index": "articles", "_id": "2" } } { "title": "AVL Trees", "content": "Self-balancing BST..." } { "index": { "_index": "articles", "_id": "3" } } { "title": "Huffman Coding", "content": "Variable-length encoding..." }
Full-Text Search Queries
# match query: full-text search with relevance scoring GET /articles/_search { "query": { "match": { "content": "algorithm performance" } } } # multi_match: search across multiple fields GET /articles/_search { "query": { "multi_match": { "query": "binary tree", "fields": ["title^2", "content", "tags"] // title weighted 2x } } } # bool query: combine must, should, must_not GET /articles/_search { "query": { "bool": { "must": [ { "match": { "content": "sorting" } } ], "should": [ { "match": { "tags": "algorithms" } } ], "must_not": [ { "match": { "title": "deprecated" } } ], "filter": [ { "range": { "published": { "gte": "2024-01-01" } } } ] } } }
Aggregations — Analytics
# Count articles per author and average title length GET /articles/_search { "size": 0, // don't return documents, only aggregation results "aggs": { "by_author": { "terms": { "field": "author.keyword", "size": 10 }, "aggs": { "avg_content_length": { "avg": { "field": "content_length" } } } }, "articles_over_time": { "date_histogram": { "field": "published", "calendar_interval": "month" } } } }
🎯 Key Takeaways
- Elasticsearch stores JSON documents in indices — no fixed schema required.
- Full-text search is Elasticsearch's core strength: tokenisation, stemming, relevance scoring.
- match queries do full-text search; term queries do exact matching (case-sensitive).
- Aggregations perform analytics on large datasets in near-real-time.
- Elasticsearch is NOT a primary database — no transactions, eventual consistency across shards.
Interview Questions on This Topic
- QWhat is Elasticsearch and when would you use it over a relational database?
- QWhat is the difference between a match query and a term query?
- QWhat are Elasticsearch aggregations used for?
Frequently Asked Questions
When should I use Elasticsearch vs PostgreSQL full-text search?
PostgreSQL full-text search is good for moderate-scale search on data already in PostgreSQL — saves you from running a separate service. Elasticsearch wins for: very large datasets (100M+ documents), complex relevance tuning, high query throughput, real-time analytics, and when you need features like auto-complete, faceted search, or fuzzy matching at scale.
What is the difference between match and term queries?
match runs the query through the same analyser as the indexed field — it tokenises, lowercases, and handles stemming. Use match for full-text search on text fields. term does an exact, unanalysed match — useful for keyword fields, IDs, and status values. Searching a text field with term often returns no results because the field was analysed (lowercased, tokenised) during indexing.
Developer and founder of TheCodeForge. I built this site because I was tired of tutorials that explain what to type without explaining why it works. Every article here is written to make concepts actually click.