Elasticsearch hard
Elasticsearch 7.x introduced the 'Search Idle' state. What is the performance optimization triggered when an index hasn't been searched for 30 seconds?
- A It automatically shrinks the index from 5 shards to 1 shard to save disk.
- B Refresh Suppression: It pauses the periodic `index.refresh_interval`. New data is still indexed but not made searchable until a search request actually occurs, drastically reducing background I/O for inactive indices.
- C It flushes the operating system's RAM cache to prioritize memory for Hot indices.
- D It disables all Replica shards to save on cross-node networking costs.
Answer: B. Refresh Suppression: It pauses the periodic `index.refresh_interval`. New data is still indexed but not made searchable until a search request actually occurs, drastically reducing background I/O for inactive indices.
This is a massive gain for log management. If you have 1,000 indices but only search the 'Last 1 hour', the other 999 indices stop wasting CPU/Disk cycles on 'Refreshes'. The first search after an idle period will have a slight latency spike as it performs the needed refresh.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- What are the two primary reasons for configuring one or more 'Replica Shards' for an index?
- When a String field is mapped as `text`, what process is performed to enable full-text search capability?
- What is the primary benefit of splitting an Elasticsearch index into multiple 'Primary Shards'?
- Every document stored in an Elasticsearch index is uniquely tracked by which mandatory metadata field?
- Elasticsearch search results include a metadata field called `_score`. What does this value primarily indicate?
- What is the primary architectural purpose of Elasticsearch in a modern software stack?