//// ============ IMPORTANT Add new terms to the Stack Docs glossary: https://github.com/elastic/stack-docs/tree/master/docs/en/glossary ============ //// [glossary] [[glossary]] = Glossary [glossary] [[glossary-analysis]] analysis:: // tag::analysis-def[] Process of converting unstructured <> into a format optimized for search. See {ref}/analysis.html[Text analysis]. // end::analysis-def[] [[glossary-api-key]] API key:: // tag::api-key-def[] Unique identifier for authentication in {es}. When {ref}/encrypting-communications.html[transport layer security (TLS)] is enabled, all requests must be authenticated using an API key or a username and password. See the {ref}/security-api-create-api-key.html[Create API key API]. // end::api-key-def[] [[glossary-auto-follow-pattern]] auto-follow pattern:: // tag::auto-follow-pattern-def[] <> that automatically configures new <> as <> for <>. See {ref}/ccr-auto-follow.html[Manage auto-follow patterns]. // end::auto-follow-pattern-def[] [[glossary-cluster]] cluster:: // tag::cluster-def[] A group of one or more connected {es} <>. See {ref}/scalability.html[Clusters, nodes, and shards]. // end::cluster-def[] [[glossary-cold-phase]] cold phase:: // tag::cold-phase-def[] Third possible phase in the <>. In the cold phase, data is no longer updated and seldom <>. The data still needs to be searchable, but it’s okay if those queries are slower. See {ref}/ilm-index-lifecycle.html[Index lifecycle]. // end::cold-phase-def[] [[glossary-cold-tier]] cold tier:: // tag::cold-tier-def[] <> that contains <> that hold time series data that is accessed occasionally and not normally updated. See {ref}/data-tiers.html[Data tiers]. // end::cold-tier-def[] [[glossary-component-template]] component template:: // tag::component-template-def[] Building block for creating <>. A component template can specify <>, {ref}/index-modules.html[index settings], and <>. See {ref}/index-templates.html[index templates]. // end::component-template-def[] [[glossary-content-tier]] content tier:: // tag::content-tier-def[] <> that contains <> that handle the <> and <> load for content, such as a product catalog. See {ref}/data-tiers.html[Data tiers]. // end::content-tier-def[] [[glossary-ccr]] {ccr} ({ccr-init}):: // tag::ccr-def[] Replicates <> and <> from <> in a <>. See {ref}/xpack-ccr.html[{ccr-cap}]. // end::ccr-def[] [[glossary-ccs]] {ccs} (CCS):: // tag::ccs-def[] Searches <> and <> on <> from a <>. See {ref}/modules-cross-cluster-search.html[Search across clusters]. // end::ccs-def[] [[glossary-data-stream]] data stream:: // tag::data-stream-def[] Named resource used to manage time series data. A data stream stores data across multiple backing <>. See {ref}/data-streams.html[Data streams]. // end::data-stream-def[] [[glossary-data-tier]] data tier:: // tag::data-tier-def[] Collection of <> with the same {ref}/modules-node.html[data role] that typically share the same hardware profile. Data tiers include the <>, <>, <>, <>, and <>. See {ref}/data-tiers.html[Data tiers]. // end::data-tier-def[] [[glossary-delete-phase]] delete phase:: // tag::delete-phase-def[] Last possible phase in the <>. In the delete phase, an <> is no longer needed and can safely be deleted. See {ref}/ilm-index-lifecycle.html[Index lifecycle]. // end::delete-phase-def[] [[glossary-document]] document:: // tag::document-def[] JSON object containing data stored in {es}. See {ref}/documents-indices.html[Documents and indices]. // end::document-def[] [[glossary-eql]] Event Query Language (EQL):: // tag::eql-def[] <> language for event-based time series data, such as logs, metrics, and traces. EQL supports matching for event sequences. See {ref}/eql.html[EQL]. // end::eql-def[] [[glossary-field]] field:: // tag::field-def[] Key-value pair in a <>. See {ref}/mapping.html[Mapping]. // end::field-def[] [[glossary-filter]] filter:: // tag::filter-def[] <> that does not score matching documents. See {ref}/query-filter-context.html[filter context]. // end::filter-def[] [[glossary-flush]] flush:: // tag::flush-def[] Writes data from the {ref}/index-modules-translog.html[transaction log] to disk for permanent storage. See the {ref}/indices-flush.html[flush API]. // end::flush-def[] [[glossary-follower-index]] follower index:: // tag::follower-index-def[] Target <> for <>. A follower index exists in a <> and replicates a <>. See {ref}/xpack-ccr.html[{ccr-cap}]. // end::follower-index-def[] [[glossary-force-merge]] force merge:: // tag::force-merge-def[] // tag::force-merge-def-short[] Manually triggers a <> to reduce the number of <> in an index's <>. // end::force-merge-def-short[] See the {ref}/indices-forcemerge.html[force merge API]. // end::force-merge-def[] [[glossary-freeze]] freeze:: // tag::freeze-def[] // tag::freeze-def-short[] Makes an index read-only and minimizes its memory footprint. // end::freeze-def-short[] See the {ref}/freeze-index-api.html[freeze API]. // end::freeze-def[] [[glossary-frozen-index]] frozen index:: // tag::frozen-index-def[] An <> reduced to a low overhead state that still enables occasional searches. See the {ref}/freeze-index-api.html[freeze API]. // end::frozen-index-def[] [[glossary-frozen-phase]] frozen phase:: // tag::frozen-phase-def[] Fourth possible phase in the <>. In the frozen phase, an <> is no longer updated and <> rarely. The information still needs to be searchable, but it’s okay if those queries are extremely slow. See {ref}/ilm-index-lifecycle.html[Index lifecycle]. // end::frozen-phase-def[] [[glossary-frozen-tier]] frozen tier:: // tag::frozen-tier-def[] <> that contains <> that hold time series data that is accessed rarely and not normally updated. See {ref}/data-tiers.html[Data tiers]. // end::frozen-tier-def[] [[glossary-hidden-index]] hidden data stream or index:: // tag::hidden-index-def[] <> or <> excluded from most <> by default. See {ref}/multi-index.html#hidden-indices[Hidden data streams and indices]. // end::hidden-index-def[] [[glossary-hot-phase]] hot phase:: // tag::hot-phase-def[] First possible phase in the <>. In the hot phase, an <> is actively updated and queried. See {ref}/ilm-index-lifecycle.html[Index lifecycle]. // end::hot-phase-def[] [[glossary-hot-tier]] hot tier:: // tag::hot-tier-def[] <> that contains <> that handle the <> load for time series data, such as logs or metrics. This tier holds your most recent, most frequently accessed data. See {ref}/data-tiers.html[Data tiers]. // end::hot-tier-def[] [[glossary-id]] ID:: // tag::id-def[] Identifier for a <>. Document IDs must be unique within an <>. See the {ref}/mapping-id-field.html[`_id` field]. // end::id-def[] [[glossary-index]] index:: // tag::index-def[] . Collection of JSON <>. See {ref}/documents-indices.html[Documents and indices]. . To add one or more JSON documents to {es}. This process is called indexing. // end::index-def[] [[glossary-index-alias]] index alias:: // tag::index-alias-def[] Secondary name for one or more <>. Most {es} APIs accept an index alias in place of an index name. See the {ref}/indices-add-alias.html[Create or update index alias API]. // end::index-alias-def[] [[glossary-index-lifecycle]] index lifecycle:: // tag::index-lifecycle-def[] Five phases an <> can transition through: <>, <>, <>, <>, and <>. See {ref}/ilm-policy-definition.html[Index lifecycle]. // end::index-lifecycle-def[] [[glossary-index-lifecycle-policy]] index lifecycle policy:: // tag::index-lifecycle-policy-def[] Specifies how an <> moves between phases in the <> and what actions to perform during each phase. See {ref}/ilm-policy-definition.html[Index lifecycle]. // end::index-lifecycle-policy-def[] [[glossary-index-pattern]] index pattern:: // tag::index-pattern-def[] String containing a wildcard (`*`) pattern that can match multiple <>, <>, or <>. See {ref}/multi-index.html[Multi-target syntax]. // end::index-pattern-def[] [[glossary-index-template]] index template:: // tag::index-template-def[] Automatically configures the <>, {ref}/index-modules.html[index settings], and <> of new <> that match its <>. You can also use index templates to create <>. See {ref}/index-templates.html[Index templates]. // end::index-template-def[] [[glossary-leader-index]] leader index:: // tag::leader-index-def[] Source <> for <>. A leader index exists on a <> and is replicated to <>. See {ref}/xpack-ccr.html[{ccr-cap}]. // end::leader-index-def[] [[glossary-local-cluster]] local cluster:: // tag::local-cluster-def[] <> that pulls data from a <> in <> or <>. See {ref}/modules-remote-clusters.html[Remote clusters]. // end::local-cluster-def[] [[glossary-mapping]] mapping:: // tag::mapping-def[] Defines how a <>, its <>, and its metadata are stored in {es}. Similar to a schema definition. See {ref}/mapping.html[Mapping]. // end::mapping-def[] [[glossary-merge]] merge:: // tag::merge-def[] Process of combining a <>'s smaller Lucene <> into a larger one. {es} manages merges automatically. // end::merge-def[] [[glossary-node]] node:: // tag::node-def[] A single {es} server. One or more nodes can form a <>. See {ref}/scalability.html[Clusters, nodes, and shards]. // end::node-def[] [[glossary-primary-shard]] primary shard:: // tag::primary-shard-def[] Lucene instance containing some or all data for an <>. When you index a <>, {es} adds the document to primary shards before <>. See {ref}/scalability.html[Clusters, nodes, and shards]. // end::primary-shard-def[] [[glossary-query]] query:: // tag::query-def[] Request for information about your data. You can think of a query as a question, written in a way {es} understands. See {ref}/search-your-data.html[Search your data]. // end::query-def[] [[glossary-recovery]] recovery:: // tag::recovery-def[] Process of syncing a <> from a <>. Upon completion, the replica shard is available for searches. See the {ref}/indices-recovery.html[index recovery API]. // end::recovery-def[] [[glossary-reindex]] reindex:: // tag::reindex-def[] Copies documents from a source to a destination. The source and destination can be a <>, <>, or <>. See the {ref}/docs-reindex.html[Reindex API]. // end::reindex-def[] [[glossary-remote-cluster]] remote cluster:: // tag::remote-cluster-def[] A separate <>, often in a different data center or locale, that contains <> that can be replicated or searched by the <>. The connection to a remote cluster is unidirectional. See {ref}/modules-remote-clusters.html[Remote clusters]. // end::remote-cluster-def[] [[glossary-replica-shard]] replica shard:: // tag::replica-shard-def[] Copy of a <>. Replica shards can improve search performance and resiliency by distributing data across multiple <>. See {ref}/scalability.html[Clusters, nodes, and shards]. // end::replica-shard-def[] [[glossary-rollover]] rollover:: // tag::rollover-def[] // tag::rollover-def-short[] Creates a new write index when the current one reaches a certain size, number of docs, or age. // end::rollover-def-short[] A rollover can target a <> or an <> with a write index. // end::rollover-def[] [[glossary-rollup]] rollup:: // tag::rollup-def[] Summarizes high-granularity data into a more compressed format to maintain access to historical data in a cost-effective way. See {ref}/xpack-rollup.html[Roll up your data]. // end::rollup-def[] [[glossary-rollup-index]] rollup index:: // tag::rollup-index-def[] Special type of <> for storing historical data at reduced granularity. Documents are summarized and indexed into a rollup index by a <>. See {ref}/xpack-rollup.html[Rolling up historical data]. // end::rollup-index-def[] [[glossary-rollup-job]] rollup job:: // tag::rollup-job-def[] Background task that runs continuously to summarize documents in an <> and index the summaries into a separate rollup index. The job configuration controls what data is rolled up and how often. See {ref}/xpack-rollup.html[Rolling up historical data]. // end::rollup-job-def[] [[glossary-routing]] routing:: // tag::routing-def[] Process of sending and retrieving data from a specific <>. {es} uses a hashed routing value to choose this shard. You can provide a routing value in <> and search requests to take advantage of caching. See the {ref}/mapping-routing-field.html[`_routing` field]. // end::routing-def[] [[glossary-runtime-fields]] runtime field:: // tag::runtime-fields-def[] <> that is evaluated at query time. You access runtime fields from the search API like any other field, and {es} sees runtime fields no differently. See {ref}/runtime.html[Runtime fields]. // end::runtime-fields-def[] [[glossary-searchable-snapshot]] searchable snapshot:: // tag::searchable-snapshot-def[] <> of an <> mounted as a <>. You can search this index like a regular index. See {ref}/searchable-snapshots.html[searchable snapshots]. // end::searchable-snapshot-def[] [[glossary-searchable-snapshot-index]] searchable snapshot index:: // tag::searchable-snapshot-index-def[] <> whose data is stored in a <>. Searchable snapshot indices do not need <> for resilience, since their data is reliably stored outside the cluster. See {ref}/searchable-snapshots.html[searchable snapshots]. // end::searchable-snapshot-index-def[] [[glossary-segment]] segment:: // tag::segment-def[] Data file in a <>'s Lucene instance. {es} manages Lucene segments automatically. // end::segment-def[] [[glossary-shard]] shard:: // tag::shard-def[] Lucene instance containing some or all data for an <>. {es} automatically creates and manages these Lucene instances. There are two types of shards: <> and <>. See {ref}/scalability.html[Clusters, nodes, and shards]. // end::shard-def[] [[glossary-shrink]] shrink:: // tag::shrink-def[] // tag::shrink-def-short[] Reduces the number of <> in an index. // end::shrink-def-short[] See the {ref}/indices-shrink-index.html[shrink index API]. // end::shrink-def[] [[glossary-snapshot]] snapshot:: // tag::snapshot-def[] Backup taken of a running <>. You can take snapshots of the entire cluster or only specific <> and <>. See {ref}/snapshot-restore.html[Snapshot and restore]. // end::snapshot-def[] [[glossary-snapshot-lifecycle-policy]] snapshot lifecycle policy:: // tag::snapshot-lifecycle-policy-def[] Specifies how frequently to perform automatic backups of a cluster and how long to retain the resulting <>. See {ref}/snapshot-lifecycle-management.html[Manage the snapshot lifecycle] // end::snapshot-lifecycle-policy-def[] [[glossary-snapshot-repository]] snapshot repository:: // tag::snapshot-repository-def[] Location where <> are stored. A snapshot repository can be a shared filesystem or a remote repository, such as Azure or Google Cloud Storage. See {ref}/snapshot-restore.html[Snapshot and restore]. // end::snapshot-repository-def[] [[glossary-source_field]] source field:: // tag::source-field-def[] Original JSON object provided during <>. See the {ref}/mapping-source-field.html[`_source` field]. // end::source-field-def[] [[glossary-split]] split:: // tag::split-def[] Adds more <> to an <>. See the {ref}/indices-split-index.html[split index API]. // end::split-def[] [[glossary-system-index]] system index:: // tag::system-index-def[] <> containing configurations and other data used internally by the {stack}. System index names start with a dot (`.`), such as `.security`. Do not directly access or change system indices. // end::system-index-def[] [[glossary-term]] term:: // tag::term-def[] See {ref}/glossary.html#glossary-token[token]. // end::term-def[] [[glossary-text]] text:: // tag::text-def[] Unstructured content, such as a product description or log message. You typically <> text for better search. See {ref}/analysis.html[Text analysis]. // end::text-def[] [[glossary-token]] token:: // tag::token-def[] A chunk of unstructured <> that's been optimized for search. In most cases, tokens are individual words. Tokens are also called terms. See {ref}/analysis.html[Text analysis]. // end::token-def[] [[glossary-tokenization]] tokenization:: // tag::tokenization-def[] Process of breaking unstructured text down into smaller, searchable chunks called <>. See {ref}/analysis-overview.html#tokenization[Tokenization]. // end::tokenization-def[] [[glossary-warm-phase]] warm phase:: // tag::warm-phase-def[] Second possible phase in the <>. In the warm phase, an <> is generally optimized for search and no longer updated. See {ref}/ilm-policy-definition.html[Index lifecycle]. // end::warm-phase-def[] [[glossary-warm-tier]] warm tier:: // tag::warm-tier-def[] <> that contains <> that hold time series data that is accessed less frequently and rarely needs to be updated. See {ref}/data-tiers.html[Data tiers]. // end::warm-tier-def[]