Elasticsearch Review
Review ES for mapping design, query DSL, analyzers, ILM, shard sizing, cluster health, and relevance tuning.
Key Checks
- Explicit mappings (dynamic: strict), keyword vs text field types, multi-field mappings
- Nested vs object types, doc_values/index disabled for unused fields
- Filter context for non-scoring conditions (cached), flag leading wildcards and script queries
- search_after for deep pagination (not offset), bounded terms queries
- Language-specific analyzers, nGram for autocomplete, synonym deployment strategy
- ILM: hot/warm/cold/delete phases, rollover conditions, index templates
- Shard sizing: 10-50GB per shard, shards < nodes*3, plan primary count at creation
- Cluster GREEN, JVM heap 50% RAM max 32GB, GC pressure monitoring
- BM25 scoring, function_score for business signals, explain in dev only
- Bulk API for batch indexing, refresh_interval -1 during bulk, alias-based reindexing
- X-Pack security enabled, TLS, DLS/FLS for multi-tenant, audit logging
Output
Severity-sorted: CRITICAL, HIGH, MEDIUM, LOW, PASSED.
1---2name: elasticsearch-review3description: Review Elasticsearch mappings, queries, index configuration, and cluster health4agent: database-reviewer5argument-hint: "<mapping-or-query-or-index-config>"6tags: [database, elasticsearch, search, performance, indexing]7user-invocable: true8---910# Elasticsearch Review1112Review ES for mapping design, query DSL, analyzers, ILM, shard sizing, cluster health, and relevance tuning.1314## Key Checks15- Explicit mappings (dynamic: strict), keyword vs text field types, multi-field mappings16- Nested vs object types, doc_values/index disabled for unused fields17- Filter context for non-scoring conditions (cached), flag leading wildcards and script queries18- search_after for deep pagination (not offset), bounded terms queries19- Language-specific analyzers, nGram for autocomplete, synonym deployment strategy20- ILM: hot/warm/cold/delete phases, rollover conditions, index templates21- Shard sizing: 10-50GB per shard, shards < nodes*3, plan primary count at creation22- Cluster GREEN, JVM heap 50% RAM max 32GB, GC pressure monitoring23- BM25 scoring, function_score for business signals, explain in dev only24- Bulk API for batch indexing, refresh_interval -1 during bulk, alias-based reindexing25- X-Pack security enabled, TLS, DLS/FLS for multi-tenant, audit logging2627## Output28Severity-sorted: CRITICAL, HIGH, MEDIUM, LOW, PASSED.