Elasticsearch medium
A document is deleted, but the total disk usage of the cluster does not immediately decrease. Why?
- A Deleted documents are moved to a 'Trash' index for 30 days by default.
- B Lucene segments are immutable. Deletions are 'Soft' (tombstones); space is only reclaimed later when segments are merged together into a new file and the old ones are deleted physically.
- C The operating system's filesystem cache is masking the change in file size.
- D Deletes in Elasticsearch only apply to the Primary Shard, while Replicas keep the data for auditing.
Answer: B. Lucene segments are immutable. Deletions are 'Soft' (tombstones); space is only reclaimed later when segments are merged together into a new file and the old ones are deleted physically.
To achieve high performance, Lucene never 'updates' a file on disk. It only writes new ones. A delete is just a bit in a separate `.del` file. Background 'Merge' threads eventually combine segments, skipping the tombstoned documents, which finally frees up the storage space.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- What are the two primary reasons for configuring one or more 'Replica Shards' for an index?
- When a String field is mapped as `text`, what process is performed to enable full-text search capability?
- What is the primary benefit of splitting an Elasticsearch index into multiple 'Primary Shards'?
- Every document stored in an Elasticsearch index is uniquely tracked by which mandatory metadata field?
- Elasticsearch search results include a metadata field called `_score`. What does this value primarily indicate?
- What is the primary architectural purpose of Elasticsearch in a modern software stack?