Book Image

Learning Elasticsearch

By : Abhishek Andhavarapu
Book Image

Learning Elasticsearch

By: Abhishek Andhavarapu

Overview of this book

Elasticsearch is a modern, fast, distributed, scalable, fault tolerant, and open source search and analytics engine. You can use Elasticsearch for small or large applications with billions of documents. It is built to scale horizontally and can handle both structured and unstructured data. Packed with easy-to- follow examples, this book will ensure you will have a firm understanding of the basics of Elasticsearch and know how to utilize its capabilities efficiently. You will install and set up Elasticsearch and Kibana, and handle documents using the Distributed Document Store. You will see how to query, search, and index your data, and perform aggregation-based analytics with ease. You will see how to use Kibana to explore and visualize your data. Further on, you will learn to handle document relationships, work with geospatial data, and much more, with this easy-to-follow guide. Finally, you will see how you can set up and scale your Elasticsearch clusters in production environments.
Table of Contents (11 chapters)
10
Exploring Elastic Stack (Elastic Cloud, Security, Graph, and Alerting)

Field data

Only non-analyzed fields are stored in doc values. For aggregations, sorting, and scripting on an analyzed field, an in-memory structure called field data is used. Unlike doc values, which live on disk, field data lives in the JVM heap memory due to which it is not very scalable and can cause out-of-memory exceptions. Field data is lazily loaded the first time you try to run an aggregation or sort on an analyzed field. Field data is built from the inverted index of the field, which is an expensive operation and can use significant memory.

Non-analyzed fields are, by default, stored in the doc values, and you can use multi-fields to index the same field as analyzed and non-analyzed fields. You can use the analyzed field for searching and the non-analyzed field for aggregations and so on. Field data is disabled by default, and if you need to run aggregations on an analyzed...