Search performance tuning in Elasticsearch - Step-by-Step Execution

Concept Flow - Search performance tuning

Receive Search Query

↓

Parse Query

↓

Check Index Settings

↓

Apply Performance Optimizations

↓

Execute Search

↓

Return Results

This flow shows how a search query is processed and optimized for better performance before returning results.

Execution Sample

Elasticsearch

GET /products/_search
{
  "query": {
    "match": { "name": "phone" }
  },
  "size": 5
}

This query searches the 'products' index for documents where the 'name' field matches 'phone', returning only 5 results.

Execution Table

Step	Action	Details	Effect on Performance
1	Receive Query	User sends search for 'phone' in 'products' index	Start processing
2	Parse Query	Identify 'match' query on 'name' field	Prepare for execution
3	Check Index Settings	Verify if 'name' field is indexed and analyzed	Ensure query can run efficiently
4	Apply Optimizations	Limit size to 5 results, use filter cache if applicable	Reduce data processed and returned
5	Execute Search	Run query on shards with applied optimizations	Faster response time
6	Return Results	Send top 5 matching documents to user	Efficient data delivery
7	Exit	Query completed successfully	Performance tuned search finished

💡 Query completes after returning limited results with optimizations applied

Variable Tracker

Variable	Start	After Step 2	After Step 4	Final
query	null	{"match": {"name": "phone"}}	{"match": {"name": "phone"}}	Executed query with size limit
results	empty	empty	empty	5 documents returned

Key Moments - 3 Insights

Why do we limit the 'size' parameter in the query?

Limiting 'size' reduces the number of results Elasticsearch returns, which lowers processing time and network load, as shown in execution_table step 4.

How does checking index settings improve performance?

Ensuring the field is indexed and analyzed properly allows Elasticsearch to use optimized data structures, speeding up the search as seen in step 3.

What is the benefit of using filter cache in search?

Filter cache stores results of frequent filters, so repeated queries run faster, improving performance as applied in step 4.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the query size limited to improve performance?

A Step 2

B Step 4

C Step 5

D Step 6

💡 Hint

Check the 'Apply Optimizations' step in the execution_table where size is set to 5.

According to variable_tracker, what is the state of 'results' after Step 4?

A 5 documents returned

B null

C empty

D query object

💡 Hint

Look at the 'results' row under 'After Step 4' in variable_tracker.

If the 'name' field was not indexed, which step would fail or slow down the search?

A Step 3

B Step 1

C Step 5

D Step 6

💡 Hint

Refer to execution_table step 3 about checking index settings.

Concept Snapshot

Search Performance Tuning in Elasticsearch:
- Parse query and check index settings
- Limit 'size' to reduce returned results
- Use filter cache for repeated filters
- Optimize queries to run faster on shards
- Return only needed data to improve speed

Full Transcript

This visual execution shows how Elasticsearch processes a search query for the term 'phone' in the 'products' index. The query is parsed, index settings are checked to ensure the 'name' field is indexed and analyzed properly. Performance optimizations like limiting the number of results to 5 and using filter cache are applied before executing the search. The search runs on shards efficiently and returns the top 5 matching documents. Variables like the query object and results change state through the steps. Key moments highlight why limiting size and checking index settings matter. Quiz questions test understanding of when optimizations happen and variable states.

Practice

1. Which of the following is a common way to improve search performance in Elasticsearch?

easy

A. Limit the number of results returned using size parameter

B. Increase the number of shards without limit

C. Disable caching completely

D. Use wildcard queries on all fields

Solution

1. Step 1: Understand result limiting

   Limiting results with size reduces data processed and returned, speeding up queries.

2. Step 2: Evaluate other options

   Increasing shards without limit can hurt performance, disabling cache reduces speed, and wildcard queries are slow.

3. Final Answer:

   Limit the number of results returned using size parameter -> Option A

4. Quick Check:

   Limiting results = faster search [OK]

Hint: Use size to limit results for faster queries [OK]

Common Mistakes:

• Thinking more shards always improve speed
• Ignoring caching benefits
• Using wildcard queries on all fields

2. Which Elasticsearch query syntax correctly limits the returned fields to only title and author?

easy

A. {"return_fields": ["title", "author"], "query": {"match_all": {}}}

B. {"fields": ["title", "author"], "query": {"match_all": {}}}

C. {"select": ["title", "author"], "query": {"match_all": {}}}

D. {"_source": ["title", "author"], "query": {"match_all": {}}}

Solution

1. Step 1: Identify correct field limiting syntax

   Elasticsearch uses _source to specify which fields to return.

2. Step 2: Check other options

   fields, select, and return_fields are not valid for limiting returned fields in this context.

3. Final Answer:

   {"_source": ["title", "author"], "query": {"match_all": {}}} -> Option D

4. Quick Check:

   Use _source to limit fields [OK]

Hint: Use _source to specify returned fields [OK]

Common Mistakes:

• Using fields instead of _source
• Trying SQL-like select syntax
• Using unsupported keys like return_fields

3. Given this Elasticsearch query, what will be the effect of adding "timeout": "2s"?

{
  "query": {"match": {"content": "fast search"}},
  "timeout": "2s"
}

medium

A. The query will fail if it takes longer than 2 seconds

B. The query will cache results for 2 seconds

C. The query will return partial results after 2 seconds

D. The query will wait 2 seconds before starting

Solution

1. Step 1: Understand timeout behavior

   Elasticsearch's timeout stops the query after the specified time and returns partial results if available.

2. Step 2: Evaluate other options

   It does not fail immediately, does not delay start, and does not control caching.

3. Final Answer:

   The query will return partial results after 2 seconds -> Option C

4. Quick Check:

   timeout returns partial results [OK]

Hint: Timeout returns partial results if query is slow [OK]

Common Mistakes:

• Assuming timeout causes query failure
• Thinking timeout delays query start
• Confusing timeout with caching duration

4. You have this query to limit results and fields:

{
  "size": 10,
  "query": {
    "_source": ["title", "date"],
    "match_all": {}
  }
}

But the query returns all fields. What is the likely mistake?

medium

A. Using size instead of limit

B. Using _source inside the query body instead of top-level

C. Missing fields parameter to limit fields

D. The match_all query ignores field limits

Solution

1. Step 1: Check placement of _source

   _source must be at the top level of the query JSON, not inside query.

2. Step 2: Review other options

   fields is deprecated for this purpose, size is correct, and match_all does not ignore field limits.

3. Final Answer:

   Using _source inside the query body instead of top-level -> Option B

4. Quick Check:

   _source must be top-level [OK]

Hint: Place _source at top level, not inside query [OK]

Common Mistakes:

• Putting _source inside query
• Confusing size with limit
• Assuming match_all ignores field filtering

5. You want to optimize a search that returns many documents but only needs the id and summary fields, and must respond within 1 second. Which combination of settings best improves performance?

hard

A. Set size to a low number, use _source to limit fields, and add timeout of 1s

B. Set size high, disable _source, and remove timeout

C. Use wildcard queries on all fields and set timeout to 5s

D. Increase shards count and use fields to limit fields

Solution

1. Step 1: Limit results and fields

   Setting size low reduces returned documents; _source limits fields to needed ones.

2. Step 2: Use timeout to keep response fast

   Adding timeout of 1 second ensures query won't hang and keeps system responsive.

3. Step 3: Evaluate other options

   High size and disabling _source increase load; wildcard queries are slow; increasing shards without need can hurt performance.

4. Final Answer:

   Set size to a low number, use _source to limit fields, and add timeout of 1s -> Option A

5. Quick Check:

   Limit size + fields + timeout = best performance [OK]

Hint: Limit size, fields, and add timeout for fast, efficient search [OK]

Common Mistakes:

• Setting size too high
• Disabling field filtering
• Ignoring timeout setting
• Increasing shards unnecessarily