elasticsearch

When to use this skill

Use this skill whenever the user wants to:

• Design index mappings with analyzers and field types
• Write search queries (match, term, bool, multi_match, nested, aggregations)
• Index, update, or bulk-load documents via the REST API
• Manage clusters (shards, replicas, snapshots, upgrades)
• Integrate Elasticsearch with Kibana or Logstash (ELK stack)

How to use this skill

Workflow

1. Design the mapping - Define field types, analyzers, and index settings
2. Index documents - Use PUT/POST or bulk API
3. Write queries - Use Query DSL with filters for caching
4. Monitor and tune - Check cluster health, slow logs, and shard balance

Quick-Start Example: Create Index and Search

// Create index with mapping
PUT /products
{
  "mappings": {
    "properties": {
      "name":        { "type": "text", "analyzer": "standard" },
      "description": { "type": "text" },
      "price":       { "type": "float" },
      "category":    { "type": "keyword" },
      "created_at":  { "type": "date" }
    }
  }
}

// Index a document
POST /products/_doc
{
  "name": "Wireless Mouse",
  "description": "Ergonomic wireless mouse with USB-C receiver",
  "price": 29.99,
  "category": "electronics",
  "created_at": "2025-01-15"
}

// Search with bool query and aggregation
GET /products/_search
{
  "query": {
    "bool": {
      "must": [{ "match": { "description": "wireless" } }],
      "filter": [{ "range": { "price": { "lte": 50 } } }]
    }
  },
  "aggs": {
    "by_category": { "terms": { "field": "category" } }
  }
}

Best Practices

1. Define explicit mappings - Avoid dynamic mapping in production; set dynamic: strict to catch errors
2. Use filters for exact matches - Filters are cached and faster than queries for keyword/range conditions
3. Paginate with search_after - Avoid deep from/size pagination; use search_after for large result sets
4. Plan shards carefully - Target 20-40 GB per shard; avoid too many small shards
5. Snapshot regularly - Use snapshot/restore for backups; test restore procedures

Keywords

elasticsearch, search, index, mapping, query DSL, aggregation, 搜索引擎, 全文检索, 聚合, ELK, Kibana, bulk API, cluster