How does Elasticsearch works?

Introduction

In today’s world, where data has become an integral part of any software. Due to this, the ability to search, analyze, and retrieve data from different sources has become crucial. There can be various issues while querying through data. These problems can be performance bottlenecks, Database management, operation challenges, or others. If the application deals with lots of data then doing analytics and quering also become harder.

To solve this problem, we need an analytical engine that can help in indexing and searching data more efficiently. One such tool is Elasticsearch. It can be integrated to enable fast and efficient data analysis.

So, today we are going to look into Elasticsearch and how it works. Here are the topics we are going to cover:

• What is Elasticsearch?
• The benefit of Using Elasticsearch?
• How does Elasticsearch work?

Let’s get started.

What is Elasticsearch?

Elasticsearch is an open-source search engine that enables fast and efficient searching, indexing, and data analysis. It can run analytics on data such as textual, numerical, geospatial, structured, and instructed. It is built on the Apache Lucene library. This library provides text-indexing and searches as the core function.

It is the main component in the Elastic Stack. It is a set of tools for data ingestion, enrichment, storage, analysis, and visualization.

Benefits of Using Elasticsearch

Elasticsearch offers a variety of benefits. Here are some of them:

• High-Speed Search: It can provide you with fast and near-real-time search capabilities.
• Scalability: It can scale horizontally. You can distribute data among multiple nodes in a cluster.
• Full-Text Search: It can perform a full-text search with ease. Users can perform complex searches across multiple fields and documents.
• Rich Querying: It offers flexible and powerful querying language. It allows you to write complex queries that included various search criteria and filters.

How Does Elasticsearch Work?

Elasticsearch works in a distributed manner. In this, data is divided into multiple shards. This data is then distributed across a cluster of nodes. This nature makes it easy to scale horizontally.

Here there 3 terms that we need to learn about before understanding the working of Elasticsearch.

• Cluster: In Elasticsearch, a cluster defines the collection of one or more nodes(server). These nodes work together to store data and perform different distributed operations. When multiple nodes join together to form a cluster, they share the workload and provide high availability.

• Node: A node is a single instance of Elasticsearch. Node is the part of a cluster. These clusters are independently capable of storing data and performing operations. Nodes can be physical machines, virtual machines, or containers.

  Based on the role of Node, it is divided into 3 different types of nodes:

  • Data Node: Responsible for storing and managing the actual data.
  • Master Node: Responsible for managing the cluster state, coordination operations, and maintaining cluster-level metadata.
  • Coordinating Node: Responsible for receiving search and indexing requests from clients. Also, routing the request to appropriate data nodes and merging the results from different data nodes.

• Shards: It is the building blocks for the distribution of data. The index that is created after getting data is further divided into small parts. These smaller parts are called shards. These shards are a self-contained index segment. It is stored on a single node.

Now, we are ready to extend to the working of Elasticsearch. It can be divided into 3 parts.

1. Documents

Documents are the basic unit of information that can be indexed in Elasticsearch. Documents can be considered as the row in a relational database. So, in this category, we add data from various sources to the Elasticsearch document. You can use ingestion tools to extract data and transform data into documents. You can use other tools too to keep Elasticsearch in sync with the data source.

Index

After storing, data needs to be indexed for querying. An index is a logical namespace or a collection of documents that share similar characteristics. It is similar to a database table in a relational database system. You can think of an index as a way to organize and group related data together.

Elasticsearch indexing involves defining an index(namespace) and specifying document structure for the data. Documents in JSON format are added to the index. Indexing allows Elasticsearch searchable.

Inverted Index

Elasticsearch stores the data from the document in a compressed and immutable form called an inverted index. It consists of a sorted list of terms(words in terms of text). These terms are stored with the reference of their document to these words containing.

An image tells a thousand words. Let’s look into it for a better understanding of the Inverted Index.

The visual representation is inspired by the Jay Gopalakrishnan's article.

2. Search

In this category, we search throughout the document. We can build a search experience for the user of the application. With different tools, we integrate the search into Elasticsearch. Tools such as Search UI and Search API are used to execute searches.

Here are 2 major processes that are running.

Querying

Elasticsearch provides queries with Query DSL (Domain Specific Query). It is flexible and powerful for constructing search queries. It allows from simple to more complex searches based on a variety of criteria. You can add criteria such as matching specific terms, phrases, ranges of values, or even complex boolean conditions.

Distributed Search

When a search request is received, Elasticsearch distributes the query to relevant shards. These shards are distributed across the cluster. Each shard runs the query against its local data independently and returns the results. The coordinating nodes merge all the results from the shards. After merging, the data is sent to the User.

3. Results

In this category, you can use tools to improve and optimize the search results. Tools such as Search API search fields and Search API boosts can be used. You can take a look at more such tools here.

The results can be optimized with the following steps:

• Query Parsing: Elasticsearch parses the users’ queries into different individual terms, phases, and logical operators.
• Query Execution: Elasticserach execute the parsed query to the indexed data and retrieve the matching documents.
• Relevance Scoring: Elasticsearch calculates the relevance score for each document based on different factors such as term frequency, field length, and others.
• Sorting: Elasticsearch applies to sorting based on the relevance score, document timestamp, numeric field, or custom criteria.
• Pagination: The sorted data are then paginated to return a subset of search results to the user.

Conclusion

Elasticsearch is a powerful tool that can help in efficient and fast searching across large data. It is able to provide Near real-time search by making data available for search after it is indexed. It also offered some other features apart from searching capabilities. These features are data aggregation, sorting, filtering, highlighting, auto-suggests, and more. Using Elasticsearch in Elastic Stack can provide you with benefits such as data visualization with Kibaan and data ingestion and processing with Logstash.

Overall, it provides a powerful, distributed search and analytical solution. I hope this article has helped you in understanding the working of Elasticsearch. Thanks for reading the article.