An Elasticsearch Production Checklist

Questions to ask

Are mappings explicit, with dynamic set deliberately and text versus keyword chosen per field? Are analyzers tested with _analyze, with synonyms at search time? Do queries put exact conditions in filter context, avoid deep pagination and have measured relevance? Do applications use aliases so reindexing is routine? Are shard sizes and counts sensible, replicas at least one and health, heap and disk monitored? Do time-series indices use ILM or data streams? Is security on, with TLS, least-privilege roles and API keys, and the cluster unreachable from the internet? Is the index kept in sync via outbox or CDC with idempotent writes, and can it be rebuilt from scratch? Are snapshots taken and restores tested?

The checklist

Use it in design and launch reviews.

[ ] explicit mappings; dynamic strict/false where appropriate; total fields bounded
[ ] text vs keyword per field; multi-fields for search + sort/aggregate
[ ] analyzers verified with _analyze; synonyms in search_analyzer
[ ] exact conditions in filter context; no leading wildcards on hot paths
[ ] pagination capped; search_after + PIT for deep reads
[ ] relevance judged on real queries before and after changes
[ ] applications use aliases; reindex + alias swap rehearsed
[ ] shard size/count reviewed; replicas >= 1; health, heap, disk alerts
[ ] ILM or data streams for time-series indices
[ ] TLS on; least-privilege roles; expiring API keys; no public exposure
[ ] outbox/CDC sync; doc _id = primary key; external versioning
[ ] snapshots scheduled to a repository; restore tested

Test the restore, not just the snapshot

Snapshots are only useful if a restore works. Restore into a separate cluster periodically and time it, so you know your real recovery time.

त्वरित जाँच: Which item belongs on an Elasticsearch production checklist?

• Rely on dynamic mapping for all fields
• Expose the cluster publicly for easier debugging
• Applications access indices through aliases so reindexing does not need downtime
• Use from/size for exports of millions of documents