Free sample lesson ยท Elasticsearch for Engineers: Top 5 Use Cases
The Inverted Index
Lesson 1 of the Wondering course Elasticsearch for Engineers: Top 5 Use Cases
The Search Problem
Imagine a library with a million books and no catalogue.
To find every book mentioning the word elasticsearch, you would open each one and read every page. That is exactly what a SQL LIKE query does across rows.
- SQL LIKE
- Inverted index
An inverted index flips this around. It stores which documents contain a word, so the answer is already written down.
Tokens, Not Rows
The index is built out of tokens, the individual words pulled from your text.
Elasticsearch breaks a document into tokens once, when the document is written. Each token becomes a key.
Under that key sits a list of the document IDs where the token appears.

Notice that each word on the left owns a list of document IDs, so the answer exists before the query arrives.
So the unit of storage is the word, not the row.
Building The Index
Indexing happens at write time, before anyone searches.
- Receive document: Elasticsearch takes in the document at write time.
- Split tokens: The text is broken into individual words called tokens.
- Create keys: Each token becomes a key in the index.
- Attach documents: The document ID is added to the list stored under that token.
Doing the hard work early is the whole trick. The query itself becomes a lookup.
What Happens At Query Time
A search arrives. Elasticsearch turns the query into tokens too.
Then it jumps straight to those keys and reads the document lists already stored there.
No row is opened. No text is re-read.
- Query arrives
- Tokenise query: The search text is broken into tokens.
- Token in index?
- Read document list: The stored list of document IDs is returned.
- No matches
- Return results
This is why full-text search runs orders of magnitude faster than scanning.
Why LIKE Falls Behind
A SQL LIKE query has no prepared answer to reach for.
It walks the table row by row and re-reads the text every single time the query runs. Work grows with the size of the table.
- SQL LIKE
- Inverted index
The inverted index pays that cost once, at write time.
A Common Misreading
The word inverted confuses people. Nothing is reversed or undone.
It simply means the mapping runs the other way: from token to document, instead of from document to token.
A normal document listing tells you which words a document holds. The inverted index tells you which documents hold a word.
What To Carry Forward
The core idea is small.
Elasticsearch maps tokens to documents rather than scanning row by row. The index is built at write time from tokens, and a query becomes a direct lookup of those keys.
- Tokens: Individual words pulled from the text.
- Documents: Stored as lists of document IDs under each token.
- Write time: The index is built before anyone searches.
- SQL LIKE: Walks the table row by row instead.
That single structural choice is what makes full-text search orders of magnitude faster than SQL LIKE.
Check yourself
An inverted index maps each token to the documents that contain it.
- True
- False
Answer: True
This statement is correct. The index reverses the usual direction: it starts with a token and lists matching document IDs.
Elasticsearch builds the index at _____, then uses the stored token keys during _____.
Answer: Elasticsearch builds the index at write time, then uses the stored token keys during query time.
Indexing performs the text-processing work when a document is written. A later search uses the prepared keys and document lists instead of rereading every document.
Why can full-text search with an inverted index be much faster than repeatedly using a SQL LIKE query on a large table?
- It stores token-to-document matches before searches occur
- It compresses every document into one database row
- It rereads less text because LIKE queries run only once
- It reverses the letters in each searchable word
Answer: It stores token-to-document matches before searches occur
The inverted index pays the text-processing cost once when documents are written. Each search then looks up token keys and reads their stored document lists, whereas SQL LIKE repeatedly scans rows and rereads text.
Keep going
This is lesson 1 of 9 in Elasticsearch for Engineers: Top 5 Use Cases. Next up:
- Shards, Replicas, and Eventual Consistency
- Use Case 1: Full-Text Search
- Use Case 2: Log Aggregation (ELK Stack)
- Use Case 3: E-commerce Product Search
- Use Case 4: Observability and APM
Wondering turns any topic into short lessons you can read, watch, or listen to, with practice questions and an AI tutor.