Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 1 year ago.
Improve this question
I need to implement fuzzy search in our web application. At first we had hardcoded options on our frontend, but now we have to work with database data (only return top 10 candidates). I just want to ask about the best approach how the data flow should be for some input field. My thoughts are:
User types any character in a search field
Frontend issues POST request to the Backend
Backend asks database to start some fuzzy search procedure
Backend returns List of 10 best results back to the frontend
Frontend displays them
My two biggest concerns are:
Can I make this happen on a large scale of data (for example 100 000) under 1 second?
What algorithm for fuzzy searching this big amount of data for relative short period of time is the best? (I am searching tool names that can consist of 2 and more words for example My Example Tool) - I have checked already some like ULT_MATCH and SOUNDEX but I don't know if it is the right choice
Is it okay to issue request every time user types a character? Doesn't this amount of HTTP requests halts our application?
Oracle does have a powerful feature for text searches, it is called Oracle Text. It allows for searching within large chunks of text or documents. It allows for stopwords, synonyms, fuzzy search, etc.
Subsecond searches should be no problem
Check Fuzzy Matching and stemming or google "Oracle text fuzzy search"
What do you think yourself ? Firing off a request against > 100000 rows every time each user types a single character ? You can probably scale your backend for that but it does not make sense... check #Randy's comment too.
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 3 years ago.
Improve this question
I found information about how number of shards, number of fields in mapping, affect performance of Elasticsearch. But I could not find any information about how indexing or not indexing a field affect cluster performance.
Imagine I have document like:
{
"name":"John Doe",
"photoPath":"/var/www/public/images/i1/j/d/123456.jpg",
"passwordHash":"$12$3b$abc...354",
"bio":"..."
}
I need to put 10 to 100 such documents to the cluster each second. When I put such document in index I am pretty sure I'd need to fulltext search for name and fulltext search for bio. I will never search for photoPath and I will never need fulltext search for password hash.
When I do my mapping I have several options:
make all fields text and analyze them with simple analyzer (i.e. tokenize by any not-character) - in that case I will have terms like "i1", "3b" or "123456" in my index
make name and bio text, make password hash keyword and make photoPath non-indexed
So my questions are:
In what ways, if any, am I improving performance in case I use the second option with custom tailored field types?
Am I correct in my assumption that having less fields indexed helps performance?
Am I correct in my assumption that indexing fewer fields will improve indexing performance?
Am I correct in my assumption that actual search will be faster if I index only what I need?
Here we go with the answers:
In what ways, if any, am I improving performance in case I use the second option with custom tailored field types? --> see detailed explanation below
Am I correct in my assumption that having less fields indexed helps performance? --> Yes
Am I correct in my assumption that indexing fewer fields will improve indexing performance? --> Yes
Am I correct in my assumption that actual search will be faster if I index only what I need? --> Most likely
Detailed explanation:
Every index comes with a mapping in which you not just specify what data should get indexed but also in how many fields your data is stored and how to process the data before storing it. In its default configuration Elasticsearch will dynamically create this mapping for you based on the type of data you sent to it.
Every single entry in your mapping consumes some bytes which will add to the size of the cluster state (the data structure that contains all the meta-information about your cluster such as information about nodes, indices, fields, shards, etc. and lives in RAM). For some users the cluster state simply got too big which severely affected performance. As a safety measurement Elasticsearch by default does not allow you to have more than 1000 fields in a single index.
Depending on mapping type and optional mapping parameters Elasticsearch will create one or more data structures for every single field you store. There are less and more "expensive" types, e.g. keyword and boolean are rather "cheap" types, whereas "text" (for full text search) is a rather expensive type, as it also requires preprocessing (analysis) of your strings. By default Elasticsearch maps strings to a multifield made up of 2 fields: one that goes by <fieldname> which is of type text and supports full-text search, and one that goes by <fieldname>.keyword of type keyword which only supports exact match search. On top of keyword fields and some other field types allow you to do analytics and use them for sorting. If you don't need one or the other, then please customize your mapping by storing it only for the use case you need. It makes a huge difference if you only need to display a field (no need to create any additional data structures for that field), whether you need to be able to search in a field (requiring specific data structures like inverted indices), or whether you need to do analytics on a field or sort by that field (requiring specific data structures like doc_values). Besides the Elasticsearch fields you specify in your mapping with a type you also can control the data structures that should get created with the following mapping-parameters: index, doc_values, enabled (just to name a few)
At search time it also makes a difference over how many fields you are searching and how big your index is. The fewer fields, the smaller the index, the better for fast search requests.
Conclusion:
So, your idea to customize your mapping by only storing some fields as keyword fields, some as text fields, some as multifields makes perfect sense!
As the question has several parts, I would try to answer them with official elasticsearch(ES) resources. Before that let's break what OP has in the ES index and every field use case:
{
"name":"John Doe", //used for full text search
"photoPath":"/var/www/pub/images/i1/j/d/123.jpg", // not used for search or retrival.
"passwordHash":"$12$3b$abc...354", // not used for search or retrival.
"bio":"..." //used for full text search**
}
Now as OP just mentioned photoPath and passwordHash aren't used for full-text search, I am assuming that these fields will not be used even for retrieval purposes.
So first, we need to understand what's the difference b/w indexing a field and storing the field and this is explained very well in this and this article. In short, if you have _source disabled(default is enabled), you will not be able to retrieve a field if it's not stored.
Now coming to the optimization part and improving the performance part. it's very simple that if you (send/store) more data what you actually need, then you wasting resources(nertwork,CPU,memory, disk). And ES is no different here.
Now coming to OP assumptions/questions:
In what ways, if any, am I improving performance in case I use the second option with custom-tailored field types? This option definitely better than first as you are not indexing the fields which you don't need for a search, but there is still room for optimization if you don't need to retrieve them, then it's better not to store them as well as remove from index mapping.
Am I correct in my assumption that having fewer fields indexed helps performance? Yes, as this way your inverted index would be smaller and you would be able to cache more data from your inverted index to file system cache and searching in small no of data is always faster. Apart from that, it helps to improve the relevance of your search by not indexing the unnecessary fields for your search.
Am I correct in my assumption that indexing fewer fields will improve indexing performance? Explained in the previous answer.
Am I correct in my assumption that the actual search will be faster if I index only what I need? It not only improves the search speed but improves indexing speed(as there will be lesser segments and merging them takes less time)
I can add a lot more information but I wanted to keep this short and simple. Let me know if anything isn't clear and would be happy to add more information.
Suppose there are fixed 1 million titles of articles to be indexed, and each article has two growing fields with "type": "rank_feature": view_count and favor_count. I have to update the value of counters every hours in order to boosting hot articles in search result.
Since the UPDATE operation in ES and Lucene is equivalent to search-delete-create, I wonder what is the proper solution in my case. Does UPDATE operation save unnecessary ANALYZE steps for those fixed titles?
An update does not make your analysis more efficient — it still has to process the entire document again.
If you have 2 fields that change frequently and other fields that are more static, I'd restructure the documents to use parent/child:
The parent contains the static fields
The child has your 2 frequently changing fields
That way you can avoid the (re) analysis of documents as much as possible. This comes at the cost of some overhead at search-time, but should be manageable if you only have a single child.
Is it possible to do bulk atomic updates in ElasticSearch?
I am aware that regular bulk updates are not atomic as noted here:
https://www.elastic.co/guide/en/elasticsearch/guide/current/bulk.html#bulk
Is there any other way to atomically update multiple documents? i.e. Either all the updates happen or none of them do.
Elasticsearch doesn't currently have a way to do what you're asking for. There are several responses to this question on the Elasticsearch site.
https://discuss.elastic.co/t/is-es-support-transaction-such-as-rollback/12579
https://discuss.elastic.co/t/rollback-es-6/85958
https://github.com/elastic/elasticsearch/issues/15316
Currently you would need to architect a solution yourself. There is an interesting blog about a potential solution here: https://blog.codecentric.de/en/2014/10/transactions-elasticsearch/
My understanding was that Elasticsearch would store the lastest copy of the document and just update the version field number? But I was playing around with a few thousand documents and had the need to index them repeatedly without changing any data in the document. My thinking was that the index size would remain the same, but that wasn't the case ... the index size seemed to increase.
This confused me a little bit, so i just wanted to seek clarification on the internal mechanism of versioning within elasticsearch.
An update is a Delete + Insert Lucene operation behind the scene.
But you should know that Lucene does not really delete the document but mark it as deleted.
To remove deleted docs, you have to optimize your Lucene segments.
$ curl -XPOST 'http://localhost:9200/twitter/_optimize?only_expunge_deletes=true'
See Optimize API. Also have a look at merge options. Merging segments happens behind the scene at some time.
For a general overview of versioning support in Elasticsearch, please refer to the Elasticsearch Versioning Support.