Search, Relevance, Aggregations, Ingestion, and Running Clusters in Production

Read before you buy: the PDF here is a free sample — the first 20 pages of the 494-page book (payments, sales and reviews on this demo site are sample data). Get the full e-book at thenexbooks on Gumroad.

Build search people trust and clusters you can sleep through, on Elasticsearch or OpenSearch.

Every application eventually gets a search box, and every system eventually produces more logs than anyone can read. Elasticsearch and OpenSearch solve both problems: they index text so it can be searched by meaning, rank results by relevance, count and group data interactively, and spread the work across a cluster. They share a common heritage, so most of what you learn applies to both, and where they have diverged this book shows you both ways.

This book takes you from your first request to a secured, monitored, backed-up production cluster. You build one realistic system step by step, and every feature appears at the moment it solves a problem you actually have, so you learn why the engine behaves the way it does, not just which endpoint to call.

What's inside

• What search engines do that databases do not, how Elasticsearch and OpenSearch relate today, and when not to use them
• A local Docker lab for both products, Dev Tools, curl, and the official Python clients
• Documents, the REST API, the inverted index, and near-real-time search
• Mappings done right: text vs keyword, multi-fields, scaled floats for prices, nested objects, and strict mappings
• Text analysis: analyzers, tokenizers, token filters, stemming, accents, and synonyms that handle "sci-fi" and "science fiction"
• The Query DSL: match, term, bool, filters, multi-match, phrases, fuzziness, highlighting, and safe user input
• How BM25 relevance works, explain, boosting, function scores, and business signals such as sales and stock
• Search UX: autocomplete, "did you mean", sorting, deep pagination with search_after and point in time
• Aggregations and faceted navigation with correct counts, plus nested, pipeline, composite, and approximate aggregations
• Log analytics with data streams, time-series queries, dashboards, SQL, ES|QL, and PPL
• Ingestion: the bulk API, Python bulk helpers, ingest pipelines with grok and dates, and shippers for both products
• Data modeling and zero-downtime reindexing with aliases
• A Python search API with search templates and tests, vector and hybrid search with rank fusion, and search quality metrics (precision, reciprocal rank, nDCG)
• Geo search, percolator alerts, and multilingual search
• Production: node roles, shards and replicas, capacity planning method, ILM and ISM, TLS, users, roles, and API keys, monitoring, troubleshooting, performance tuning, snapshots, upgrades, and disaster recovery

One running example, start to finish. You build search and analytics for Pagewright, a fictional online bookstore and marketplace where Pagewright sells new books and independent sellers list used copies. You design the books index, fix zero-result searches with synonyms, add facets and autocomplete, expose it all through a small Python API, experiment with vector and hybrid search, collect and parse web logs into a data stream, chart errors and latency, and run everything on a production-style cluster with lifecycle policies, security, monitoring, and nightly snapshots. The catalog is small enough to check by hand, so every hit count, bucket, and total in the book can be verified.

Current and honest. The book targets Elasticsearch 8.x and 9.x and OpenSearch 2.x and 3.x, and shows both syntaxes wherever the APIs differ — security, lifecycle management, vector search, point in time, query languages, and snapshot policies. Where a feature is newer or varies between releases, the text says so. Licensing and subscription tiers are described neutrally, with a reminder to read the current terms. It contains no invented benchmarks or statistics: example responses are clearly marked as illustrative, and relevance scores are explained rather than made up. Every chapter includes requests, Python code, Tips, Notes, Warnings, exercises, and Key Takeaways, and the appendices give you a cheat sheet, copy-ready templates, a production checklist, and a glossary.

Format: PDF, 494 pages (A4), linked table of contents and bookmarks. English. First Edition, 2026. Published by thenexbooks. This book is independent and is not affiliated with, sponsored by, or endorsed by Elastic, the OpenSearch Project, or the OpenSearch Software Foundation.

Table of Contents

Part I — Foundations

• Ch 1 · Search Engines, Elasticsearch, and OpenSearch: What They Are and When to Use Them
• Ch 2 · Setting Up Your Lab: Docker, Security, Dev Tools, and Python Clients
• Ch 3 · Documents, Indices, and the REST API
• Ch 4 · Mappings and Field Types: Designing the Books Index
• Ch 5 · Text Analysis: Analyzers, Tokenizers, and Token Filters

Part II — Search and Relevance

• Ch 6 · Query DSL Fundamentals: Match, Term, Bool, and Filters
• Ch 7 · Full-Text Search in Depth: Multi-Match, Phrases, Fuzziness, and Highlighting
• Ch 8 · How Relevance Works: BM25, Explain, and Boosting
• Ch 9 · Tuning Relevance: Function Score, Synonyms, and Business Signals
• Ch 10 · Search UX: Autocomplete, Suggestions, Sorting, and Pagination

Part III — Aggregations and Analytics

• Ch 11 · Aggregation Fundamentals: Metrics and Buckets
• Ch 12 · Faceted Search: Combining Queries, Filters, and Aggregations
• Ch 13 · Advanced Aggregations: Nested, Pipeline, Composite, and Approximate Results
• Ch 14 · Log Analytics: Data Streams, Time Series Queries, and Dashboards
• Ch 15 · Beyond the Query DSL: SQL, ES|QL, and PPL

Part IV — Ingestion and Data Modeling

• Ch 16 · Bulk Indexing and the Python Clients
• Ch 17 · Ingest Pipelines: Parsing, Enriching, and Transforming Documents
• Ch 18 · Shipping Data: Agents, Beats, Logstash, Data Prepper, and Fluent Bit
• Ch 19 · Data Modeling and Reindexing: Nested, Join, Denormalization, and Zero-Downtime Changes

Part V — Building Search Applications

• Ch 20 · Building a Search API: Search Templates, Query Builders, and a Python Service
• Ch 21 · Vector and Hybrid Search: Embeddings, kNN, and Rank Fusion
• Ch 22 · Measuring Search Quality: Judgments, Metrics, and Search Analytics
• Ch 23 · Geo, Percolator, and Multilingual Search

Part VI — Running Clusters in Production

• Ch 24 · Cluster Architecture: Nodes, Shards, Replicas, and Capacity Planning
• Ch 25 · Index Lifecycle: ILM, ISM, Rollover, Data Tiers, and Retention
• Ch 26 · Security: Authentication, Roles, TLS, and API Keys
• Ch 27 · Monitoring, Troubleshooting, and Performance Tuning
• Ch 28 · Snapshots, Upgrades, Disaster Recovery, and the Pagewright Production Case Study

Appendices
A · Elasticsearch and OpenSearch Cheat Sheet
B · Templates and Reference
C · Production Checklist
D · Glossary

Book details