ElasticSearch

A Distributed RESTful Search Engine

http://www.elasticsearch.com

ElasticSearch is a distributed RESTful search engine built for the cloud. Features include:

• Distributed and Highly Available Search Engine.
  • Each index is fully sharded with a configurable number of shards.
  • Each shard can have one or more backups.
  • Read / Search operations performed on either primary or backup shards.
• Multi Tenant with Multi Types.
  • Support for more than one index.
  • Support for more than one type per index.
  • Index level configuration (number of shards, index storage, …).
• Various set of APIs
  • HTTP RESTful API
  • Native Java API.
  • All APIs perform automatic node operation rerouting.
• Document oriented
  • No need for upfront schema definition.
  • Schema can be defined per type for customization of the indexing process.
• Reliable, Asynchronous Write Behind for long term persistency.
• (Near) Real Time Search.
• Built on top of Lucene
  • Each shard is a fully functional Lucene index
  • All the power of Lucene easily exposed through simple configuration / plugins.
• Per operation consistency
  • Single document level operations are atomic, consistent, isolated and durable.
• Open Source under Apache 2 License.

Getting Started

Fist of all, DON’T PANIC. It will take 5 minutes to get the gist of what ElasticSearch is all about.

Installation

• Download and unzip the ElasticSearch installation.
• Run bin/elasticsearch -f on unix, or bin/elasticsearch.bat on windows.
• Run curl -X GET http://localhost:9200/.
• Start more servers …

Indexing

Lets try and index some twitter like information. First, lets create a twitter user, and add some tweets (the twitter index will be created automatically):

curl -XPUT http://localhost:9200/twitter/user/kimchy -d '{ name: "Shay Banon" }'

curl -XPUT http://localhost:9200/twitter/tweet/1 -d \
'{ user: "kimchy", postDate: "2009-11-15T13:12:00", message: "Trying out Elastic Search, so far so good?" }'

curl -XPUT http://localhost:9200/twitter/tweet/2 -d \
'{ user: "kimchy", postDate: "2009-11-15T14:12:12", message: "Another tweet, will it be indexed?" }'

Now, lets see if the information was added by GETting it:

curl -X GET http://localhost:9200/twitter/user/kimchy?pretty=true
curl -X GET http://localhost:9200/twitter/tweet/1?pretty=true
curl -X GET http://localhost:9200/twitter/tweet/2?pretty=true

Searching

Mmm search…, shouldn’t it be elastic?
Lets find all the tweets that kimchy posted:

curl -XGET http://localhost:9200/twitter/tweet/_search?q=user:kimchy\&pretty=true

We can also use the JSON query language ElasticSearch provides instead of a query string:

curl -XPOST http://localhost:9200/twitter/tweet/_search?pretty=true -d \
'{ query : { term : { user: "kimchy" } } }'

Just for kicks, lets get all the documents stored (we should see the user as well):

curl -XGET http://localhost:9200/twitter/_search?pretty=true -d \
'{ query : { matchAll : {} } }'

We can also do range search (the postDate was automatically identified as date)

curl -XGET http://localhost:9200/twitter/_search?pretty=true -d \
'{ query : { range : { postDate : { from : "2009-11-15T13:00:00", to : "2009-11-15T14:00:00" } } } }'

There are many more options to perform search, after all, its a search product no? All the familiar Lucene queries are available through the JSON query language, or through the query parser.

Multi Tenant – Indices and Types

Maan, that twitter index might get big (in this case, index size == valuation). Lets see if we can structure our twitter system a bit differently in order to support such large amount of data.

ElasticSearch support multiple indices, as well as multiple types per index. In the previous example we used an index called twitter, with two types, user and tweet.

Another way to define our simple twitter system is to have a different index per user. Here is the indexing curl’s in this case:

curl -XPUT http://localhost:9200/kimchy/info/1 -d '{ name: "Shay Banon" }'

curl -XPUT http://localhost:9200/kimchy/tweet/1 -d \
'{ user: "kimchy", postDate: "2009-11-15T13:12:00", message: "Trying out Elastic Search, so far so good?" }'

curl -XPUT http://localhost:9200/kimchy/tweet/2 -d \
'{ user: "kimchy", postDate: "2009-11-15T14:12:12", message: "Another tweet, will it be indexed?" }'

The above index information into the kimchy index, with two types, info and tweet. Each user will get his own special index.

Complete control on the index level is allowed. As an example, in the above case, we would want to change from the default 5 shards with 1 backup per index, to only 1 shard with 1 backup per index (== per twitter user). Here is how this can be done (the configuration can be in yaml as well):

curl -XPUT http://localhost:9200/another_user/ -d \
'{ index : { numberOfShards : 1, numberOfReplicas : 1 } }'

Search (and similar operations) are multi index aware. This means that we can easily search on more than one
index (twitter user), for example:

curl -XGET http://localhost:9200/kimchy,another_user/_search?pretty=true -d \
'{ query : { matchAll : {} } }'

Or on all the indices:

curl -XGET http://localhost:9200/_search?pretty=true -d \
'{ query : { matchAll : {} } }'

{One liner teaser}: And the cool part about that? You can easily search on multiple twitter users (indices), with different boost levels per user (index), making social search so much simpler (results from my friends rank higher than results from my friends friends).

Distributed, Highly Available, and Write Behind

Lets face it, things will fail….

ElasticSearch is a highly available and distributed search engine. Each index is broken down into shards, and each shard can have one or more backups. By default, an index is created with 5 shards and 1 backup per shard (5/1). There are many topologies that can be used, including 1/10 (improve search performance), or 20/1 (improve indexing performance, with search executed in a map reduce fashion across shards).

In order to play with Elastic Search distributed nature, simply bring more nodes up and shut down nodes. The system will continue to serve requests (make sure you use the correct http port) with the latest data indexed.

If the whole cluster is brought down, all the indexed data will be lost (each shard local storage is temporal). For long term persistency, write behind should be enabled. This is as simple as configuring the elasticsearch.yml configuration file (which effectively enables write behind to file system for all indices created unless configured otherwise when creating the index):

gateway:
  type: fs

Alternatively, elastic search can be started with the following command line:
elasticsearch -f -Des.index.gateway.type=fs.

The above configuration will persist the indices create on ElasticSearch to a file system (path can be configured) in an asynchronous, reliable fashion. Other gateways implementations can be easily implemented and more will be provided out of the box in later versions (did someone say AmazonS3/Hadoop/Cassandra?).

Where to go from here?

We have just covered a very small portion of what ElasticSearch is all about. For more information, please refer to: .

Building from Source

ElasticSearch uses Gradle:http://www.gradle.org for its build system. In order to create a distribution, simply run gradlew devRelease, the distribution will be created under build/distributions.

License

This software is licensed under the Apache 2 license, quoted below.

Copyright 2009-2010 Elastic Search <http://www.elasticsearch.com>

Licensed under the Apache License, Version 2.0 (the "License"); you may not
use this file except in compliance with the License. You may obtain a copy of
the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
License for the specific language governing permissions and limitations under
the License.