SynfraCore
Synfracore
Start Learning
Navigation

Academies

Platform

RoadmapsLabsCertificationsInterviewPYQsAI AssistantCareer
Start Learning Free🗺️ Learning Roadmaps

ElasticsearchAdvanced

Production patterns, performance, security hardening

✍️
Written by senior engineers. Reviewed for technical accuracy.· Updated 2025 · SynfraCore Elasticsearch Team
Expert Content

Elasticsearch — Advanced

Index Lifecycle Management (ILM)

json
// Automate index rollover and deletion for time-series data

PUT /_ilm/policy/logs-policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "1d",
            "max_docs": 100000000
          },
          "set_priority": { "priority": 100 }
        }
      },
      "warm": {
        "min_age": "7d",
        "actions": {
          "readonly": {},
          "shrink": { "number_of_shards": 1 },
          "forcemerge": { "max_num_segments": 1 },
          "set_priority": { "priority": 50 }
        }
      },
      "cold": {
        "min_age": "30d",
        "actions": {
          "freeze": {},
          "set_priority": { "priority": 0 }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": { "delete": {} }
      }
    }
  }
}

// Data stream with ILM
PUT /_index_template/logs-template
{
  "index_patterns": ["logs-*"],
  "data_stream": {},
  "template": {
    "settings": {
      "index.lifecycle.name": "logs-policy",
      "index.number_of_shards": 3,
      "index.number_of_replicas": 1
    }
  }
}

Elasticsearch Cheatsheet

bash
# ── CLUSTER ───────────────────────────────────────────────
curl -s localhost:9200/_cluster/health?pretty
curl -s localhost:9200/_cat/nodes?v
curl -s localhost:9200/_cat/indices?v&s=store.size:desc&h=index,docs.count,store.size,health

# ── INDEX MANAGEMENT ──────────────────────────────────────
curl -X PUT localhost:9200/my-index -H 'Content-Type: application/json' \
    -d '{"settings": {"number_of_shards": 3, "number_of_replicas": 1}}'
curl -X DELETE localhost:9200/my-index
curl -X POST localhost:9200/my-index/_forcemerge?max_num_segments=1
curl -X POST localhost:9200/my-index/_refresh

# ── SEARCH ────────────────────────────────────────────────
# Quick search
curl "localhost:9200/my-index/_search?q=field:value&size=10&pretty"

# Count
curl localhost:9200/my-index/_count -d '{"query": {"match": {"status": "error"}}}'

# Explain scoring
curl -X GET localhost:9200/my-index/_explain/doc-id \
    -d '{"query": {"match": {"title": "elasticsearch"}}}'

# Profile query performance
curl -X GET localhost:9200/my-index/_search \
    -d '{"profile": true, "query": {"match": {"title": "test"}}}'

# ── ALIASES ───────────────────────────────────────────────
# Zero-downtime index swaps
curl -X POST localhost:9200/_aliases -d '{
    "actions": [
        {"remove": {"index": "products-v1", "alias": "products"}},
        {"add":    {"index": "products-v2", "alias": "products"}}
    ]
}'
Share:
Join our Community
Daily tips, job alerts, interview help — join engineers learning together
Quick Check — Elasticsearch
1 / 1

What is the first step when optimizing a production system?

Up Next
🧪
ElasticsearchHands-on Labs
Practice in real environments
Also Worth Exploring
← Back to all Elasticsearch modules
IntermediateRoadmap