As your journey with Elasticsearch progresses you should learn about shards, how they affect your cluster, and also how to work with them.

An index can be broken into pieces that can be spread across nodes on a cluster. This is handy if the size of your index, for example, exceeds the size of a hard drive on one of the nodes in your cluster.  This is conceptually similar to how Mongodb stores data in glusterfs by breaking it into smaller pieces and spreading it across nodes in the cluster.

Keep reading

The Ransoming of Elasticsearch

Posted by Ben Hundley on January 12, 2017

Early this morning, users around the world reported hacks of their unsecured Elasticsearch clusters. A data ransoming group attacked vulnerable clusters they found on cloud providers. This follows the widely reported instances of tens of thousands of MongoDB databases being ransomed last week. Copycats virally spread the ransoming, and the copycatting has now apparently spread to Elasticsearch.

Keep reading

Not yet enjoying the benefits of a hosted ELK-stack enterprise search on Qbox? Discover how easy it is to manage and scale your Elasticsearch environment.

Get Started 5 minutes to get started

So far we have seen the grouping of documents based on various aggregations like term, date histogram, and more. In this post we are going to see the limitations of the date_histogram aggregation in certain cases, and how to overcome that by employing elasticsearch scripting.

Keep reading

In the previous post we saw how to set up, configure, and index network traffic data using packetbeat, logstash and elasticsearch. 

In this post we will see how to visualize the data with the help of Kibana.

Keep reading

Note: Our Hosted Elasticsearch product's clusters have backups created for you automatically. If you are interested in a hosted solution with free 24/7 support, sign up and spin up a cluster in 5 minutes here:

As your cluster and your indexes grow you will see an increasing need to retain the data that you have accumulated. Remember that your backups are worth nothing if you do not test that they can actually restore. If your backups become corrupt and you need to restore at a critical time, you will probably have a huge problem. 

The snapshot and restore module allows you to create snapshots of your indices, or a snapshot of the cluster as a whole. The snapshot of your respective indices or whole cluster can then be stored in a remote repository. 

There are different types of repositories that are supported. If you have a shared file system, for example an NFS filesystem that is accessible by all nodes at the same mounting point, then you can use that to store your indices or entire cluster snapshot to.

Keep reading

In this tutorial, we discuss geolocation and explain what kinds of data notation can be used for locations, as well as how they can be aggregated and filtered.

Geolocation is a powerful a tool for searching. It can, for example, help you find out where most of the comments on your site come from, or find the nearest delivery for the user.

Keep reading