Field guides for running Elasticsearch and OpenSearch well.
September 16, 2026 · QueryCrunch
The cluster that falls over at 3am usually has 4,000 fields in one index template. How dynamic mapping gets out of hand, what it costs in heap and cluster state, and the four mechanisms that fix it: explicit dynamic templates, dynamic: false, flattened, and subobjects: false.
Read moreSeptember 15, 2026 · QueryCrunch
A snapshot you have never restored is a hypothesis. How to size repositories, schedule SLM policies that do not collide with ingest peaks, rehearse a restore against real numbers, and avoid the frozen-tier and cross-version traps.
Read moreSeptember 14, 2026 · QueryCrunch
A p99 that drifted from 80 ms to 900 ms is a measurement problem first. The order we work through it on Elasticsearch and OpenSearch: took vs. client time, the slow log, the profile API, thread pool queues, caches, and the fixes that actually move the number.
Read moreSeptember 14, 2026 · QueryCrunch
Major-version upgrades fail on the things nobody tested: a removed setting, a plugin that has no build for the new version, a client library that stops talking. Here is the sequence we run — snapshot, deprecation sweep, clone-and-rehearse, rolling upgrade, verify — and where the rollback really is.
Read moreSeptember 14, 2026 · QueryCrunch
The piped query language is a real improvement for incident analysis and multi-stage stats, and the wrong tool for ranked search or a hot request path. Concrete examples, the row limits that bite, and a rollout order.
Read more