elasticsearch
Elasticsearch DBA skill for index/mapping design, query tuning, cluster sizing and operations, shard/replica strategy, ILM, monitoring, troubleshooting (hot nodes, GC, rejected requests), and safe reindexing/upgrades. Use for tasks like designing search schemas, diagnosing performance issues, and operating ES in production.
When & Why to Use This Skill
This Elasticsearch DBA skill provides comprehensive expertise in index and mapping design, query performance tuning, and production cluster operations. It assists developers and SREs in optimizing search schemas, managing shard strategies, and implementing Index Lifecycle Management (ILM) to ensure high availability, scalability, and low-latency search performance in production environments.
Use Cases
- Search Schema Design: Creating optimized index mappings and templates with precise field types (keyword vs. text) to prevent mapping explosion and ensure efficient data storage.
- Performance Diagnosis & Tuning: Using profile APIs and slow logs to identify bottlenecks, optimize heavy aggregations, and implement 'search_after' for efficient deep pagination.
- Cluster Capacity Planning: Determining optimal shard counts and replica strategies based on data volume, growth projections, and latency SLOs.
- Infrastructure Operations: Troubleshooting production issues such as hot nodes, garbage collection (GC) overhead, and thread pool rejections to maintain cluster stability.
- Data Lifecycle Management: Implementing ILM policies for hot-warm-cold architectures to automate data rollover, shrinking, and deletion for time-series logs.
- Safe Migrations: Planning and executing zero-downtime reindexing and version upgrades using index aliases and rolling update runbooks.
| name | elasticsearch |
|---|---|
| description | Elasticsearch DBA skill for index/mapping design, query tuning, cluster sizing and operations, shard/replica strategy, ILM, monitoring, troubleshooting (hot nodes, GC, rejected requests), and safe reindexing/upgrades. Use for tasks like designing search schemas, diagnosing performance issues, and operating ES in production. |
elasticsearch
Use this skill for Elasticsearch(ES)相关设计、性能与运维(DBA/中间件)任务。
Defaults / assumptions to confirm
- ES version and deployment (self-hosted / managed)
- Cluster topology (nodes, roles, storage type)
- Data volume and retention requirements
- Query patterns (search vs analytics) and latency SLO
Workflow
- Understand use-cases and query patterns
- Primary user journeys: keyword search, filtering, aggregations, sorting.
- Write patterns: append-only logs vs frequent updates.
- Required consistency and freshness (near real-time delay tolerance).
- Index & mapping design
- Define index naming convention and templates.
- Choose correct field types (
keywordvstext,date,long,scaled_float). - Analyze/analyzer strategy for language (e.g., Chinese tokenizer) if needed.
- Avoid mapping explosion; control dynamic mappings.
- Plan
_sourceand stored fields usage; consider doc values.
- Shards and replicas
- Pick shard count with future growth and reindex cost in mind.
- Avoid too many small shards; target shard size range (e.g., 10–50GB) depending on workload.
- Set replicas for availability and read scaling.
- Query tuning
- Use
profileand slow logs to find bottlenecks. - Reduce heavy aggregations; precompute when possible.
- Use filters with
keywordfields; cache-friendly queries. - Pagination: prefer
search_afterfor deep pages; avoid largefrom+size.
- Lifecycle management
- Use ILM (hot-warm-cold-delete) for time-series data.
- Rollover policies by size/time; manage retention.
- Cluster operations & stability
- Monitor heap, GC, CPU, disk watermarks, thread pool rejections.
- Detect hot keys/indices; rebalance shards carefully.
- Snapshot/restore; restore drills; retention policy.
- Safe changes
- Mapping changes often require reindex; plan alias-based migrations.
- Use index aliases for zero-downtime cutover.
- Upgrade runbook: compatibility, rolling upgrade, backout plan.
Outputs
- Mapping/index template proposal + rationale.
- Shard/replica sizing plan + expected capacity.
- Performance diagnosis report (evidence → root cause → fixes).
- Migration plan (reindex + alias cutover + verification).