Documents, indices and near real time

Key points

• A document is a JSON object; the bytes you sent are kept in _source and returned on a hit.
• An index is a set of documents sharing one mapping - mapping types were removed entirely in 8.0.
• A new document is not searchable at once: it waits in a buffer until the next refresh.
• index.refresh_interval defaults to 1s, hence the phrase near real time.
• Durability comes from the translog, fsynced on every request by default, not from the refresh.
• An index with no search traffic for 30 seconds goes search idle and stops refreshing until queried.

Example

PUT /articles/_doc/1
{ "title": "Tuning Elasticsearch", "status": "published" }

# not visible yet to a search - refresh happens within 1s

POST /articles/_refresh          # force it (tests only)
PUT  /articles/_doc/2?refresh=wait_for   # block until visible

PUT /articles/_settings
{ "index.refresh_interval": "30s" }      # bulk loading: refresh less

Acknowledged is durable, refreshed is searchable, flushed is committed - three different moments.