elasticsearch

The difference is simple: filters are cached and don’t influence the score, therefore faster than queries. Have a look here too. Let’s say a query is usually something that the users type and pretty much unpredictable, while filters help users narrowing down the search results , for example using facets.

must means: The clause (query) must appear in matching documents. These clauses must match, like logical AND. should means: At least one of these clauses must match, like logical OR. Basically they are used like logical operators AND and OR. See this. Now in a bool query: must means: Clauses that must match for the … Read more

OR is spelled should AND is spelled must NOR is spelled should_not Example: You want to see all the items that are (round AND (red OR blue)): { “query”: { “bool”: { “must”: [ { “term”: {“shape”: “round”} }, { “bool”: { “should”: [ {“term”: {“color”: “red”}}, {“term”: {“color”: “blue”}} ] } } ] } … Read more

This happens when Elasticsearch thinks the disk is running low on space so it puts itself into read-only mode. By default Elasticsearch’s decision is based on the percentage of disk space that’s free, so on big disks this can happen even if you have many gigabytes of free space. The flood stage watermark is 95% … Read more

If you ever need to delete all the indexes, this may come in handy: curl -X DELETE ‘http://localhost:9200/_all’ Powershell: Invoke-WebRequest -method DELETE http://localhost:9200/_all

Yep, Use a better option source filter. If you’re searching with JSON it’ll look something like this: { “_source”: [“user”, “message”, …], “query”: …, “size”: … } In ES 2.4 and earlier, you could also use the fields option to the search API: { “fields”: [“user”, “message”, …], “query”: …, “size”: … } This is … Read more