Deploying Elasticsearch
Search and analytics engine with full-text search, aggregations, and Kibana.
PlatformsAdvanced
Why
Elasticsearch provides distributed full-text search, aggregations, and log analytics at scale. With Kibana, you get visualization; with Logstash, ingestion pipelines.
Platform-as-a-Service adoption grew 24% in 2024 as teams shift from VM management to git-push deploys. the cloud infrastructure market reached $330B in 2024, growing 22% year-over-year (Synergy Research), and PaaS layers capture the majority of new workloads.
When
Use Elasticsearch for search, log analytics, and metrics. Avoid for primary DB (use as secondary).
How
1. Docker — elasticsearch:8 with Kibana
2. Cluster — 3 nodes minimum for HA
3. Index — create index with mapping
4. Search — query DSL for full-text + filters
5. Aggregations — buckets + metrics for analytics
6. Kibana — visualization at :5601
7. Security — enable TLS + auth (default in 8.x)
Example
# docker-compose.yml
services:
es:
image: elasticsearch:8
environment:
discovery.type: single-node
xpack.security.enabled: false
ports: ["9200:9200"]
kibana:
image: kibana:8
environment: ELASTICSEARCH_HOSTS: http://es:9200
ports: ["5601:5601"]
# Index and search
curl -X PUT localhost:9200/users -H 'Content-Type: application/json' -d '
{ "mappings": { "properties": { "name": { "type": "text" } } } }'
curl -X POST localhost:9200/users/_doc -d '{ "name": "Alice" }'
curl localhost:9200/users/_search?q=name:alice
Common Problems
- ⚠Heap too large — set ES_JAVA_OPTS to 50% of RAM, leaves half for Lucene
- ⚠Single node no HA — development only, production needs 3 nodes
- ⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical
Best Practices
- ✓Set heap to 50% of RAM — half for JVM, half for Lucene off-heap
- ✓Use index lifecycle management — auto-rollover and delete old indices
- ✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit