Free sample lesson ยท Elasticsearch for Engineers: Top 5 Use Cases

The Inverted Index

Lesson 1 of the Wondering course Elasticsearch for Engineers: Top 5 Use Cases

The Search Problem

Imagine a library with a million books and no catalogue.

To find every book mentioning the word elasticsearch, you would open each one and read every page. That is exactly what a SQL LIKE query does across rows.

Two ways to find a word
  • SQL LIKE
  • Inverted index

An inverted index flips this around. It stores which documents contain a word, so the answer is already written down.

Tokens, Not Rows

The index is built out of tokens, the individual words pulled from your text.

Elasticsearch breaks a document into tokens once, when the document is written. Each token becomes a key.

Under that key sits a list of the document IDs where the token appears.

A token pointing to the documents that contain it

Notice that each word on the left owns a list of document IDs, so the answer exists before the query arrives.

So the unit of storage is the word, not the row.

Building The Index

Indexing happens at write time, before anyone searches.

From document to index entry
  • Receive document: Elasticsearch takes in the document at write time.
  • Split tokens: The text is broken into individual words called tokens.
  • Create keys: Each token becomes a key in the index.
  • Attach documents: The document ID is added to the list stored under that token.

Doing the hard work early is the whole trick. The query itself becomes a lookup.

What Happens At Query Time

A search arrives. Elasticsearch turns the query into tokens too.

Then it jumps straight to those keys and reads the document lists already stored there.

No row is opened. No text is re-read.

Path of a search query
  • Query arrives
  • Tokenise query: The search text is broken into tokens.
  • Token in index?
  • Read document list: The stored list of document IDs is returned.
  • No matches
  • Return results

This is why full-text search runs orders of magnitude faster than scanning.

Why LIKE Falls Behind

A SQL LIKE query has no prepared answer to reach for.

It walks the table row by row and re-reads the text every single time the query runs. Work grows with the size of the table.

Where the work happens
  • SQL LIKE
  • Inverted index

The inverted index pays that cost once, at write time.

A Common Misreading

The word inverted confuses people. Nothing is reversed or undone.

It simply means the mapping runs the other way: from token to document, instead of from document to token.

What exactly is inverted here?

A normal document listing tells you which words a document holds. The inverted index tells you which documents hold a word.

What To Carry Forward

The core idea is small.

Elasticsearch maps tokens to documents rather than scanning row by row. The index is built at write time from tokens, and a query becomes a direct lookup of those keys.

How the pieces fit
  • Tokens: Individual words pulled from the text.
  • Documents: Stored as lists of document IDs under each token.
  • Write time: The index is built before anyone searches.
  • SQL LIKE: Walks the table row by row instead.

That single structural choice is what makes full-text search orders of magnitude faster than SQL LIKE.

Check yourself

An inverted index maps each token to the documents that contain it.

  • True
  • False

Answer: True

This statement is correct. The index reverses the usual direction: it starts with a token and lists matching document IDs.

Elasticsearch builds the index at _____, then uses the stored token keys during _____.

Answer: Elasticsearch builds the index at write time, then uses the stored token keys during query time.

Indexing performs the text-processing work when a document is written. A later search uses the prepared keys and document lists instead of rereading every document.

Why can full-text search with an inverted index be much faster than repeatedly using a SQL LIKE query on a large table?

  • It stores token-to-document matches before searches occur
  • It compresses every document into one database row
  • It rereads less text because LIKE queries run only once
  • It reverses the letters in each searchable word

Answer: It stores token-to-document matches before searches occur

The inverted index pays the text-processing cost once when documents are written. Each search then looks up token keys and reads their stored document lists, whereas SQL LIKE repeatedly scans rows and rereads text.

Keep going

This is lesson 1 of 9 in Elasticsearch for Engineers: Top 5 Use Cases. Next up:

  1. Shards, Replicas, and Eventual Consistency
  2. Use Case 1: Full-Text Search
  3. Use Case 2: Log Aggregation (ELK Stack)
  4. Use Case 3: E-commerce Product Search
  5. Use Case 4: Observability and APM

Start this course free

Wondering turns any topic into short lessons you can read, watch, or listen to, with practice questions and an AI tutor.