This document provides an overview and primer on Elasticsearch (ES). It discusses basics like CRUD operations, schemas, and indexing. It covers managed vs non-managed clusters and strategies for sharding, tuning performance, and reducing storage costs. The presenter works with ES at NortonLifeLock and has an Elastic certification. They demonstrate CRUD operations and take questions at the end, quizzing attendees on topics like changing shards, supported deployment targets, storing without indexing, responsibilities in managed clusters, and changing replicas.

1. A short Primer on ES
Sandeep Kanabar
https://www.linkedin.com/in/sandeepkanabar/
Gujarat Meetup Aug 2022

2. • Work at NortonLifeLock (formerly Symantec)
• Set up multiple ELK stacks on Azure / AWS
• Re-architecting / tuning performance
• Recently acquired Elastic Certification
About Me

3. • Basics - CRUD
• Schema
• Managed / Non-Managed
• Tuning
Overview

4. • Demo - CRUD operations
Basics

5. • Control your data
• Mapping Explosion
• Templates
• Indexed vs Non-Indexed
Schema

6. • Managed vs Non-Managed
• Automatic vs Manual Cars ??
• Modified Bikes ??
Cluster Strategy

7. Managed VS Non-Managed
Add / remove nodes at a click
Ease of Upgrades / Patching
Cannot Scale Disk Space
without increasing CPU / RAM
More expensive
Needs scripting
More maintenance overhead
Can allocate more disk space
for fixed RAM and CPU
More cost effective **
Cluster Strategy

8. • Average Ingestion Rate per day = ~13 GB without
replicas and = ~26 GB with 1 replica
• Couples in a room ??
Cluster Strategy

9. Sharding Strategy
• Primary shards changed from 9 to 11
• Per shard = ~40 GB

10. • Day-wise indices
"settings" : {
"index" : {
"number_of_shards" : "11",
"number_of_replicas" : "1"
}
},
Sharding Strategy

11. Reducing Storage Costs
• Index only the fields you really need to search.
• Define Mappings and set dynamic:false
• Enable best_compression and Force-merging
...
"settings" : {
"index" : {
"codec" : "best_compression",
…
}
},

12. Shards & Apples
• I got such a small apple, Sir
• Un-even shards - nightmare

13. Giving Back 
• Contribute to the community
• Become a speaker at ES meetups
• Elastic Contributor Program
• Be GENUINE. Rewards will automatically come

14. • Thank you.
• Questions

15. • QUIZ TIME

16. The number of shards in an Elasticsearch index can
be easily changed anytime using the _settings API
• True
• False
Q1

17. Elasticsearch can be deployed on which of the
following?
• AWS Cloud
• Azure Cloud
• Google Cloud
• On-Prem
• All of above
Q2

18. It is possible to STORE a field in Elasticsearch without
INDEXING it.
• True
• False
Q3

19. In a managed Elasticsearch, you are responsible for
OS upgrades and patches.
• True
• False
Q4

20. The number of replicas in an Elasticsearch index can
be easily changed anytime using the _settings API.
• True
• False
Q5

21. In Managed Elasticsearch, YOU are responsible for
efficient sharding strategy.
• True
• False
Q6