Which Elasticsearch Analyzer for the job?

Elasticsearch provides a few built-in analyzers. Here’s a breakdown of each and where best to use it. No Analyzer Disabling the Analyzer will store your data with no tokens and can only be searched by exact matches of the full

Elasticsearch _source field

The _source field contains the original JSON document body of an Elaticsearch document. It is not indexed nor searchable, but it can be returned when executing fetch requests. Keeping the _source field saved with the document comes with substantial storage

Elasticsearch Index Templates

Index templates allow you to specify index settings and mappings that will automatically be applied when an index is first created. It uses a simple pattern match to control when a template is applied. An index can have multiple patterns

Elasticsearch Document Deduplication With Logstash

Removing duplicate documents from Elasticsearch saves disk space and will speed-up searches. This saves you time and makes you more productive. I setup and manage ELK (Elasticsearch, Logstash and Kibana) clusters that process hundreds of millions log lines per day.

Remove Elasticsearch Node

Example assumes the node IP Address is and that you have jq installed. If you do not have jq remove | jq . from the commands. Expand the number of shards that can be reallocated Choose settings appropriate for