Türker Yıldırım

elasticsearch

  • Reindexing without downtime, using an alias

    Note2 min read

    A mapping change usually cannot be applied in place, so it means building a new index — and if the application names the index directly, that is a…

  • Delete Elasticsearch indices older than 30 days

    Snippet1 min read

  • Centralised logging that answers a question

    Deep dive17 min read

    Four servers, eleven log files, and an incident reconstructed from three of them. Shipping first and parsing second, structured events, and the correlation id that makes it useful.

  • Deep pagination is the wrong shape of question

    Note2 min read

    from=10000&size=10 makes every shard produce 10,010 hits and the coordinating node sort 50,050 of them to return ten. The cost grows with the offset, which is why there…

  • Elasticsearch 6 allows one mapping type per index

    Note1 min read

    An index could hold several types — product and review in one index — and they shared a Lucene field space underneath, so two types with a field…

  • Index lifecycle before the disk fills, not after

    Note2 min read

    Daily indices grow linearly and nothing removes them, so a logging cluster works beautifully for four months and then stops accepting writes with a disk watermark error at…

  • The keyword type replaced not_analyzed

    Note2 min read

    Expressing “index this exactly, do not tokenise it” used to be “type”: “string”, “index”: “not_analyzed”. From 5.0 the string type is split in two and the intent is…

  • Shard count is decided once and regretted later

    Note1 min read

    The number of primary shards is fixed when the index is created and cannot be changed. The default of five was chosen for a different era of cluster…

  • A filter context does not score, and is cached

    Note2 min read

    Every clause in a query context computes a relevance score, including the ones that are yes-or-no questions — in stock, in this category, under this price. Scoring them…

  • The analyzer decides what matching even means

    Note1 min read

    A search that fails to find an obvious result is almost never a query problem. Text is tokenised and normalised at index time, and the query goes through…