Elasticsearch
What it is: Distributed search and analytics engine built on Apache Lucene. Real-time full-text search, log analysis, metrics.
What It Does Best
Full-text search. Relevance scoring, fuzzy matching, autocomplete. Search UIs that actually work.
Log analytics. ELK Stack (Elasticsearch, Logstash, Kibana). Ingest, search, visualize logs at scale.
Real-time indexing. Documents searchable within seconds. No batch processing delays.
Key Features
Inverted indexes: Fast full-text search on any field
Aggregations: Analytics and metrics on search results
RESTful API: JSON over HTTP for easy integration
Distributed by design: Horizontal scaling across nodes
Kibana integration: Powerful visualization and dashboards
Pricing
Open Source: Free, SSPL/Elastic License (self-hosted)
Elastic Cloud Starter: ~$95/month
Elastic Cloud Standard: Scales with usage, pay-as-you-go
Enterprise: Custom pricing with support and features
When to Use It
✅ Application search functionality
✅ Log and event data analysis
✅ Real-time analytics dashboards
✅ E-commerce product search
✅ Monitoring and observability (with ELK stack)
When NOT to Use It
❌ Primary transactional database (not ACID compliant)
❌ Relational data with complex joins
❌ Guaranteed data durability (use proper backups)
❌ Small, simple search needs (too complex)
❌ Strong consistency required (eventual consistency)
Common Use Cases
Application search: Product catalogs, content search, autocomplete
Log analysis: Application logs, security events, audit trails
Observability: Metrics, traces, logs for monitoring
Security analytics: SIEM, threat detection, anomaly detection
Business analytics: Real-time dashboards and reporting
Elasticsearch vs Alternatives
vs Solr: Elasticsearch easier to use, Solr more mature for some use cases
vs Algolia: Algolia managed and faster, Elasticsearch more flexible and cheaper
vs Splunk: Splunk better for enterprise, Elasticsearch open source and cheaper
Unique Strengths
Full ELK stack: Complete observability platform (Elasticsearch, Logstash, Kibana)
Schema-free: Index any JSON without defining schema upfront
Powerful query DSL: Flexible query language for complex searches
Near real-time: Data searchable within ~1 second of indexing
Bottom line: The search engine for everything. Application search, log analytics, security monitoring. Powerful query DSL, but complex to tune. Worth the learning curve for search-heavy workloads.