Elasticsearch: Distributed Search Engine, Vector Search, and the OpenSearch Fork
Elasticsearch is a distributed search and analytics engine built on Lucene. It is a strong fit when a team needs configurable lexical retrieval, aggregations, near-real-time indexing, and optional vector search at a scale or operational boundary that exceeds a database index. It is not a zero-administration database, and its current licensing must be described precisely.
Understand the index and shard model
A mapping defines field types and analyzers. Each index is divided into primary shards with optional replicas; a search fans out to relevant shard copies and merges their results. Shard count is an architectural choice, not a tuning knob to maximize. Too many small shards consume heap and coordination time, while oversized shards slow relocation and recovery. Elastic's shard-sizing guidance recommends measuring with production-shaped data and queries.
Use stable document IDs, explicit mappings, index templates, and aliases. Build a new versioned index when an incompatible analyzer or mapping changes, validate it, then switch an alias atomically. Keep the previous index until rollback is no longer needed.
Separate exact filters, lexical relevance, and vectors
Put identifiers and facets in keyword or typed fields; analyze human text into text fields. Filters enforce tenant, status, date, and permission constraints without pretending they are relevance. BM25 and phrase queries remain strong for exact terminology. Approximate k-nearest-neighbor search can broaden conceptual recall, and hybrid fusion can combine both candidate sets.
Profile representative queries rather than copying boosts from examples. The search documentation covers query, vector, ranking, highlighting, and pagination behavior. Deep offset pagination, wildcard-heavy queries, and unbounded aggregations deserve explicit limits.
Plan operations before production traffic
Capacity tests must include concurrent indexing, merges, refreshes, node loss, and recovery—not only warm read benchmarks. Monitor heap pressure, rejected work, shard health, disk watermarks, merge time, query percentiles, indexing lag, and snapshot success. Take repository-backed snapshots and perform restore drills; replicas protect availability, not deletion or corruption.
Choose a license and distribution deliberately
Elastic's 2024 change added the OSI-approved AGPLv3 as an option for the free portions of Elasticsearch and Kibana source code, alongside SSPL and Elastic License 2.0. Elastic's default distribution continues under ELv2. The official licensing FAQ is the source to review with counsel for redistribution or managed-service use. Do not describe every artifact simply as Apache-licensed or every Elastic distribution simply as AGPL.
OpenSearch is the Apache-2.0-licensed fork with its own release path, APIs, plugins, and managed offerings. Migration compatibility changes over time; test mappings, clients, security, snapshots, and query results rather than assuming either direction is a drop-in switch.
Published · Updated