Best Practices für die Indexierungsleistung

Why is indexing performance crucial? It's about efficiently adding data to Elasticsearch. Fast indexing means your data is searchable sooner and your cluster resources are used effectively.

This lesson will show you how to speed things up!

When you index a document, Elasticsearch doesn't just store it. It goes through a process:

• Analysis: Text fields are broken down into terms.
• Storage: Document is added to Lucene segments.
• Refresh: Segments are made searchable.
• Flush: Segments are written to disk.

Each step has performance implications.

Indexing documents one by one means a separate network request and processing overhead for each. Imagine sending thousands of individual letters instead of one large package.

This approach is fine for occasional updates, but for large datasets, it's very inefficient and slow.

Bulk indexing allows you to send multiple index, update, or delete operations in a single API request.

This drastically reduces network round trips and overhead, making data ingestion much faster. It's the go-to method for loading large amounts of data.

The bulk API uses a special format: action_and_metadata followed by the document_body. Each pair must be on its own line.

Try indexing two documents in one go:

When a document is indexed, it's not immediately searchable. Elasticsearch periodically "refreshes" an index, making newly indexed documents visible for search.

• Frequent refreshes: Documents become searchable faster, but consume more resources (CPU, I/O).
• Less frequent refreshes: Slower searchability, but better indexing performance.

The default refresh interval is 1 second.

For large bulk indexing operations, you can temporarily disable refreshes or increase the interval. Remember to set it back afterwards!

Disable refreshes:

Elasticsearch stores data in Lucene segments. Each refresh creates new segments. Too many small segments can degrade query performance.

Elasticsearch automatically merges smaller segments into larger ones in the background. This process is resource-intensive but crucial for query speed.

For indices that are no longer being written to (read-only), you can explicitly trigger a force merge to consolidate segments into a single segment (or a few larger ones).

This can significantly improve search performance, but it's a heavy operation and should only be done on static indices.

You're about to ingest 1 million new documents into an Elasticsearch index. Which of the following strategies would best improve the indexing speed?

Great job! You've learned key strategies to optimize Elasticsearch indexing performance:

• Use the Bulk API for large data loads.
• Adjust refresh intervals (e.g., disable/increase) during bulk indexing.
• Understand segment merging and consider _forcemerge for static indices.

These practices ensure your data is ingested quickly and efficiently!