Search Production Checklist

Mappings are explicit; dynamic mapping is strict or disabled on indices receiving external data.

Fields that are only stored, never queried, have indexing disabled.

Shard sizes are in the tens of gigabytes, and total shards per node are in the low hundreds.

Applications read and write through aliases, never concrete index names.

Time-based data uses rolling indices with a lifecycle policy, not one growing index.

refresh_interval is tuned for the workload rather than left at the default for bulk-ingest indices.