Optimize Search Query Performance in Elasticsearch: Best Practices

To optimize search query performance in Elasticsearch, use filters instead of queries when possible, avoid expensive wildcard or regex queries, and leverage keyword fields for exact matches. Also, keep your index mappings efficient and use caching features like request_cache to speed up repeated queries.

Syntax

Elasticsearch search queries use a JSON structure where you specify the query type and its parameters. Common query types include match, term, and bool. Filters can be applied inside bool queries to improve performance by caching results.

• query: Defines the search criteria.
• match: Full-text search on analyzed fields.
• term: Exact value match on keyword fields.
• bool: Combines multiple queries with must, filter, should, and must_not.
• filter: Used for caching and faster exact matches without scoring.

json

{
  "query": {
    "bool": {
      "must": [
        { "match": { "field": "value" } }
      ],
      "filter": [
        { "term": { "status": "active" } }
      ]
    }
  }
}

Example

This example shows a search query that uses a bool query with a match clause for full-text search and a filter clause for exact matching. Using filter improves performance because it caches the filter results and does not calculate scores.

json

{
  "query": {
    "bool": {
      "must": {
        "match": {
          "description": "fast search"
        }
      },
      "filter": {
        "term": {
          "status": "published"
        }
      }
    }
  }
}

Output

{
  "hits": {
    "total": 2,
    "hits": [
      {"_id": "1", "_source": {"description": "fast search engine", "status": "published"}},
      {"_id": "3", "_source": {"description": "fast search query", "status": "published"}}
    ]
  }
}

Common Pitfalls

Common mistakes that slow down Elasticsearch queries include:

• Using wildcard queries like *term or term* which are slow because they scan many terms.
• Running regex queries on large datasets without limits.
• Not using keyword fields for exact matches, causing unnecessary full-text analysis.
• Ignoring caching by placing filters inside must clauses instead of filter.

Correct usage of filters and avoiding expensive queries improves speed.

json

{
  "query": {
    "wildcard": {
      "title": "*search"
    }
  }
}

// Better approach:
{
  "query": {
    "wildcard": {
      "title.keyword": "search*"
    }
  }
}

Quick Reference

• Use filter clauses for exact matches to enable caching.
• Avoid leading wildcards and regex queries on large fields.
• Use keyword fields for exact term matching.
• Keep mappings simple and avoid unnecessary fields.
• Enable request_cache for repeated queries.

Key Takeaways

Use filters instead of queries for exact matches to improve caching and speed.

Avoid expensive wildcard and regex queries that scan many terms.

Use keyword fields for exact matching instead of analyzed text fields.

Keep your index mappings simple and avoid unnecessary fields.

Enable request caching for repeated queries to reduce load.