Elasticsearch for Developers — make.com

A two-day, hands-on course that takes developers from “I’ve barely touched Elasticsearch” to “I can build, query, and tune real search and analytics features”.

Each day targets a different group:

• Day 1 — Elasticsearch Fundamentals is for developers with almost zero Elasticsearch experience. We build the mental model from scratch, get a local environment running, and learn to index, read, and search data.
• Day 2 — Advanced Elasticsearch is for senior developers who already use Elasticsearch and want to go deeper: advanced queries, aggregations, performance, and the operational concepts a developer needs to ship reliable features.

Everything is done through the REST API in Kibana Dev Tools, so the knowledge transfers to any client library (JavaScript, Python, Java, Go, …) — the JSON is the same.

How to read the code blocks. Snippets are written in Kibana Dev Tools / curl-style notation: GET /index/_search, POST /index/_doc, etc. You can paste them straight into Dev Tools.

Day 1 — Elasticsearch Fundamentals

Audience: developers new to Elasticsearch.

01 — Introduction and architecture

• What Elasticsearch is and when to use it (vs. relational databases)
• Core concepts: cluster, node, index, shard, replica
• How Elasticsearch stores data (Lucene, inverted index, segments)
• Installing and running a local environment (Docker Compose: ES + Kibana)
• First contact with the REST API via Kibana Dev Tools

02 — Data model and CRUD

• Document, index, mapping — analogy with relational databases
• Indexing documents (PUT, POST)
• Reading, updating, deleting (GET, _update, DELETE)
• Bulk API for batch operations
• Dynamic mapping vs. explicit mapping

03 — Basic search

• Query DSL — request structure
• match, term, range, bool query (must / should / must_not / filter)
• Full-text search vs. exact match
• Relevance and scoring — a basic understanding of _score
• Results: hits, total, pagination (from / size)

04 — Mapping and analyzers

• Data types: text, keyword, integer, date, nested, object
• What happens when a document is indexed — text analysis step by step
• Built-in analyzers (standard, whitespace, language analyzers)

Day 2 — Advanced Elasticsearch

Audience: senior developers already using Elasticsearch.

Each part below ends with a hands-on lab. Complete the lab before moving to the next part.

05 — Advanced querying

05a — Custom analyzers

• The analysis pipeline: char filter → tokenizer → token filter
• Building a custom analyzer with html_strip, asciifolding, stop words, stemming, and synonyms
• Verifying with _analyze and "explain": true
• Index-time vs search-time synonyms; _reload_search_analyzers
• Lab: Build and verify a custom analyzer with synonyms and Czech diacritic folding

05b — Modeling relationships

• Why flat object arrays cause cross-object false positives
• nested queries with inner_hits and nested sort
• join (parent-child): has_child, has_parent, routing requirements
• Decision guide: nested vs join vs denormalization vs application-side join
• Lab: nested query false-positive demo + parent-child join field exercise

05c — Highlighting and autocomplete

• Highlighting: custom tags, fragment control, fvh / plain / unified highlighter types
• Highlighting inside inner_hits for nested fields
• completion suggester: FST-based prefix autocomplete with weights and fuzzy matching
• search_as_you_type and edge_ngram alternatives
• Lab: Highlighting fragments + completion suggester with popularity ordering

05d — Custom relevance scoring

• function_score: field_value_factor, decay functions (gauss, linear, exp), weight filters
• score_mode and boost_mode combinations
• script_score in Painless: safe field access, parameterization, performance rules
• When to use function_score vs script_score
• Lab: Build and compare function_score and script_score queries; inspect with _explain

06 — Aggregations

06a — Bucket and metric aggregations

• The aggs block, size: 0 pattern, and response structure
• terms, date_histogram, range bucket aggregations
• avg, sum, min, max, stats, cardinality, percentiles metrics
• Accuracy trade-offs: shard_size, precision_threshold, compression
• Lab: Channel revenue breakdown, monthly histogram, delivery time percentiles

06b — Nested and multi-level aggregations

• Metric inside bucket; bucket inside bucket
• filter aggregation to scope a sub-bucket without a new axis
• nested aggregation for querying nested objects (items)
• reverse_nested to climb back to parent-level fields
• Lab: Revenue by loyalty tier × country; item category analysis with reverse_nested

06c — Pipeline aggregations

• Parent pipelines: derivative, cumulative_sum, moving_fn, bucket_script, bucket_selector
• Sibling pipelines: max_bucket, avg_bucket
• buckets_path syntax and gap_policy
• Practical pitfalls: high-cardinality terms, missing time filters, composite pagination
• Lab: Monthly sales trend with derivative + moving average; discount rate by country with bucket_selector

07 — Performance and scaling

07a — Shard strategy

• What a shard costs (heap, CPU, cluster overhead)
• Sizing heuristics; over-sharding vs under-sharding symptoms
• _split, _shrink, _reindex — choosing the right reshard path
• The safe-change workflow: new index → reindex → alias flip → cleanup
• Lab: Create, reindex, and flip an alias from a 2-shard to a 3-shard index

07b — ILM and data streams

• Calendar indices vs rollover indices; when ILM applies (append-only time-series)
• Hot/warm/cold/delete phases; rollover conditions
• Wiring ILM via index template + write alias bootstrap
• Data streams: backing indices, @timestamp requirement, append-only model
• Common ILM failures; _ilm/explain troubleshooting
• Lab: ILM pipeline end-to-end with manual rollover + data stream creation and verification

07c — Caching and query profiling

• Shard request cache (aggregations, size: 0)
• Query/filter cache (filter context → cached bitsets)
• Fielddata cache dangers; keyword subfield as the fix
• _profile API: reading per-shard query trees and aggregation timings
• Kibana Search Profiler; slow query log configuration
• Lab: Filter vs must context comparison; profile a wildcard query and rewrite it

07d — Performance anti-patterns and templates

• Eight common anti-patterns: missing time filter, high-cardinality terms, deep pagination, wildcards, text-field aggregation, scripts in hot paths, mapping explosion, huge _source
• Component templates (_component_template) and index templates (_index_template)
• composed_of for reusable building blocks; priority for conflict resolution
• _simulate_index dry-run before creating real indices
• Lab: PIT + search_after pagination; dynamic mapping demo; composable template with simulation

08 — Operations, integration and best practices

08a — Cluster health and monitoring

• Green / yellow / red: what each means for traffic
• Diagnostics: _cat/shards, _cluster/allocation/explain, disk watermark chain
• Safe actions for yellow and red states
• Five signals that predict production incidents (heap, disk, rejections, pending tasks, unassigned shards)
• _nodes/stats, per-index _stats, Kibana Stack Monitoring
• Lab: Intentional yellow state; allocation explain; read the monitoring baseline from your cluster

08b — Snapshots and backups

• Snapshot repositories: filesystem, S3-compatible
• Incremental snapshots: wait_for_completion, verify, list
• Safe restore: rename pattern to avoid clobbering live data
• Snapshot Lifecycle Management (SLM): schedule, retention, manual trigger
• Lab: Register a repo, take a snapshot, restore to a renamed index, validate, set up SLM

08c — Ingest pipelines and best practices

• Common processors: grok, dissect, date, convert, rename, remove, set, geoip
• _simulate before deploying; on_failure for visible error handling
• index.default_pipeline to apply automatically via templates
• Decision guide: ingest pipeline vs Beats vs Logstash
• Full best-practices checklist for the whole course
• Lab: Build and test a normalization pipeline with simulate, on_failure, and default_pipeline

Supporting material

• Exercises — hands-on tasks for both days.
• sample-data/ — a realistic e-commerce dataset (shop-orders-demo) used in many examples and exercises.

What you’ll be able to do after the course

After Day 1, you can:

• Explain what Elasticsearch is, when to reach for it, and how it differs from a relational database.
• Run a local ES + Kibana stack and talk to it through Dev Tools.
• Index, read, update, and delete documents (single and bulk).
• Write match / term / range / bool queries and read the results.
• Design a basic mapping and understand how text analysis turns a string into searchable tokens.

After Day 2, you can:

• Build custom analyzers and model relationships with nested / join.
• Add highlighting, autocomplete, and custom relevance scoring.
• Write multi-level aggregations for analytics features.
• Reason about shards, ILM, caching, and templates to keep features fast.
• Diagnose cluster health, profile slow queries, and choose the right ingestion path.