October 26, 2026 · QueryCrunch
es_rejected_execution_exception is backpressure, not a hardware verdict. How to read write threadpool stats, size bulk requests by bytes, cut the per-document cost with refresh_interval and mapping changes, spot merge-bound storage — and how to tell when the cluster genuinely does need more nodes.
Read moreOctober 12, 2026 · QueryCrunch
Mappings are mostly immutable, so every field type fix becomes a reindex. The alias indirection, dual-write and catch-up options, _reindex throttling that does not melt the cluster, and the verification step before you cut over.
Read moreOctober 5, 2026 · QueryCrunch
When a second region or a second cluster appears, CCS and CCR solve different problems and cost very differently. Connection modes, round-trip behavior, soft-delete retention leases, follower lag, and a two-region layout that keeps storage single-copy.
Read moreSeptember 21, 2026 · QueryCrunch
kNN search is fast when the vectors fit in page cache and miserable when they don't. What int8, int4, and binary quantization actually cost in recall, how oversampling and rescoring buy it back, and how to size the nodes before you commit.
Read moreSeptember 21, 2026 · QueryCrunch
Logs get the cost attention; metrics quietly grow. How TSDS index mode, synthetic _source, and ILM downsampling cut metrics storage by an order of magnitude — the constraints they impose, what resolution you give up, and the rollout order that keeps dashboards working.
Read moreSeptember 21, 2026 · QueryCrunch
Adding nodes does not fix an imbalanced cluster. How to confirm a hot spot, the four mechanisms that cause it — write-heavy shard placement, custom routing, oversized shards, and mixed roles — and the allocator settings that actually move load.
Read moreSeptember 18, 2026 · QueryCrunch
Both Elastic and AWS now sell a serverless tier where you never see a node. The architecture is genuinely different — compute separated from object storage — and so is the bill. Here is how the units price out, what you give up, and the workload shapes where it wins.
Read moreSeptember 16, 2026 · QueryCrunch
The cluster that falls over at 3am usually has 4,000 fields in one index template. How dynamic mapping gets out of hand, what it costs in heap and cluster state, and the four mechanisms that fix it: explicit dynamic templates, dynamic: false, flattened, and subobjects: false.
Read moreSeptember 15, 2026 · QueryCrunch
A snapshot you have never restored is a hypothesis. How to size repositories, schedule SLM policies that do not collide with ingest peaks, rehearse a restore against real numbers, and avoid the frozen-tier and cross-version traps.
Read moreSeptember 14, 2026 · QueryCrunch
A p99 that drifted from 80 ms to 900 ms is a measurement problem first. The order we work through it on Elasticsearch and OpenSearch: took vs. client time, the slow log, the profile API, thread pool queues, caches, and the fixes that actually move the number.
Read moreSeptember 14, 2026 · QueryCrunch
Major-version upgrades fail on the things nobody tested: a removed setting, a plugin that has no build for the new version, a client library that stops talking. Here is the sequence we run — snapshot, deprecation sweep, clone-and-rehearse, rolling upgrade, verify — and where the rollback really is.
Read moreSeptember 14, 2026 · QueryCrunch
The piped query language is a real improvement for incident analysis and multi-stage stats, and the wrong tool for ranked search or a hot request path. Concrete examples, the row limits that bite, and a rollout order.
Read moreSeptember 11, 2026 · QueryCrunch
Elasticsearch's logsdb index mode applies index sorting and synthetic _source to log data streams and typically halves storage. Here is what it actually changes, what it costs you at read and ingest time, how to measure the saving on your own data, and what the OpenSearch equivalents are.
Read moreJune 9, 2026 · QueryCrunch
Index lifecycle management is where retention policy becomes storage cost. Working recipes for hot/warm/cold/frozen phases, the min_age semantics that trip everyone, and the checks that keep policies actually running.
Read moreMay 14, 2026 · QueryCrunch
Oversharding wastes heap; undersharding stalls recovery. The working rules for shard count and size on Elasticsearch and OpenSearch, and how to check where your cluster stands today.
Read more