Textbook of Linux

← Software

Elasticsearch

A distributed search and analytics engine.

Elasticsearch indexes documents for fast full-text and structured search at scale. It builds on Apache Lucene under the hood and adds a distributed layer: each index is split into shards that are replicated across nodes, queries fan out across the cluster, and results are merged. The Elasticsearch query DSL covers boolean text matching, scoring, aggregations (faceted search, metric, bucket), geo queries, and many other operations.

Shay Banon released Elasticsearch in 2010, growing it into the "E" of the ELK / Elastic Stack alongside Logstash (ingestion), Kibana (visualisation), and Beats (lightweight shippers). Elastic NV went public in 2018. In 2021 the company relicensed from Apache 2.0 to a dual Elastic Licence v2 / SSPL, which prompted AWS to fork the last Apache-licensed release into OpenSearch. In 2024 Elastic added back the AGPL-3.0 as a third option for new releases.

Elasticsearch is the most widely deployed open-source search engine, powering search on many large websites and serving as the analytical backend behind many SIEM and observability deployments. It also has substantial use in geospatial search, full-text product catalogues, and as a generic JSON document store with good query ergonomics.

Debian/Ubuntu: sudo apt install elasticsearch   # via Elastic APT repo
Fedora/RHEL:   sudo dnf install elasticsearch
Or via Docker: docker run -p 9200:9200 docker.elastic.co/elasticsearch/elasticsearch:8.11.0