Elasticsearch Review

Elasticsearch is a distributed search and analytics engine and vector database. The README describes near real-time search, vector search, retrieval-augmented generation, full-text search, and analytics over logs, metrics, APM, and security data. OpenAlternative lists horizontal scaling for large datasets and heavy query loads, real-time indexing and search, schema flexibility without downtime, text analysis and relevance scoring, location and numeric range queries, aggregations for analytics, and a REST API with client libraries. The current version shown is v9.5.5.

For development, the README recommends a start-local script that uses Docker to launch Elasticsearch and Kibana, and it warns against using that setup in production (Windows users need Docker Desktop and WSL). You can also build from source with Gradle (./gradlew localDistro) or use Elastic Cloud for a managed deployment. Production self-managed clusters need system configuration the docs call important: vm.max_map_count set to 1048576 for mmap-based index storage, at least 4096 threads for the Elasticsearch user, a file descriptor limit of at least 65,535, a lower net.ipv4.tcp_retries2 so failures are detected sooner, and swap disabled or memory locked (bootstrap.memory_lock) so heap memory is not swapped out. Bootstrap checks run at node startup and, in production mode, a failed check prevents the node from starting. Automatic JVM heap sizing assumes Elasticsearch is the main resource consumer on the host.

Most teams use Elasticsearch through Kibana for dashboards and exploration or through client libraries in their applications. Index design, shard sizing, and relevance tuning are where the operational effort lies. On licensing, an August 2024 Elastic post says the project now offers ELv2, SSPL, and AGPL, that existing users can carry on as before, and that the earlier license change led to a fork with a different name, OpenSearch. This section reflects the README, the system-settings documentation, the licensing blog post, and the pricing page; we did not run a cluster.

• Full-text search with relevance scoring and text analysis
• Vector search and RAG support
• Aggregations for analytics, plus location and range queries
• Horizontal scaling with real-time indexing
• REST API and client libraries
• Log, metric, APM, and security analytics within the Elastic Stack

• A mature, battle-tested engine for search and log analytics at scale
• Rich query and aggregation capabilities with a huge ecosystem
• AGPL is again an option for those who want an OSI-approved license
• Several ways to buy: Hosted (resource-based), Serverless (usage-based), or self-managed (license-based)

• The default licenses (ELv2 and SSPL) are not OSI-approved open source, and AGPL has network-copyleft obligations
• Production nodes will not start until system settings such as vm.max_map_count, file descriptors, and swap are configured
• Operating clusters (shards, memory, upgrades) takes real expertise
• The README's local setup is explicitly not for production
• Self-managed support has only two tiers (Platinum and Enterprise) and no uptime SLA, since you manage the infrastructure

Elasticsearch can be self-managed for free. On the commercial side, Elastic's pricing page describes Hosted as resource-based, Serverless as usage-based (both pay as you go monthly or prepaid), and self-managed as license-based, tied to the number of nodes and RAM used, with a 99.95% monthly uptime SLA for Platinum and Enterprise on Hosted and Serverless and free trials available. The pages we reviewed list no specific prices.

Algolia, Coveo, AWS Kendra, and Sumo Logic are hosted search and analytics services. Elasticsearch is the self-managed counterpart, with far more flexibility and far more operational responsibility. Algolia gives you instant, typo-tolerant search as a service, and Elasticsearch gives you the engine to build that yourself plus log and vector use cases. Lighter open-source engines such as Meilisearch or Typesense are easier for simple site search, and OpenSearch is the Apache-licensed fork of the earlier Elasticsearch code.

• Teams building large-scale search, log analytics, or vector retrieval
• Organizations that want to self-manage their search infrastructure
• Developers who need fine control over relevance and aggregations

• Small sites that just need simple search
• Teams without operations expertise and no budget for a managed service
• Organizations that cannot accept any of the available license options