Available in legacy Mattermost Enterprise Edition E20
Elasticsearch provides enterprise-scale deployments with optimized search performance and prevents performance degradation and timeouts.
For Mattermost v6.0, a minimum of Elasticsearch v7.x is supported. Previous versions of Mattermost, including v5.38 and earlier releases, support Elasticsearch v5.x, v6.x, and v7.x.
Elasticsearch allows you to search large volumes of data quickly, in near real-time, by creating and managing an index of post data. The indexing process can be managed from the System Console after setting up and connecting an Elasticsearch server. The post index is stored on the Elasticsearch server and is updated constantly after new posts are made. In order to index existing posts, a bulk index of the entire post database must be generated.
The default Mattermost database search starts to show performance degradation at around 2.5 million posts, depending on the specifications for the database server. If you expect your Mattermost server to have more than 2.5 million posts, we recommend using Elasticsearch for optimum search performance. For deployments with over five million posts, Elasticsearch is required to avoid significant performance issues (such as timeouts) with search and at-mentions.
From Mattermost v5.26, you can filter inactive users, search by user role, and also search for terms inside links. This update introduces a breaking change which affects the “from” part of the search. To avoid this, reindex your Elasticsearch instance/cluster prior to upgrading.
The set up process for the Elasticsearch server is documented in the official Elasticsearch documentation.
You must install the ICU Analyzer Plugin when setting up Elasticsearch for Mattermost.
Follow these steps to connect your Elasticsearch server to Mattermost and to generate the post index.
Go to System Console > Environment > Elasticsearch.
Set Enable Elasticsearch Indexing to
trueto enable the other the settings on the page. Once the configuration is saved, new posts made to the database will be automatically indexed on the Elasticsearch server.
Set the Elasticsearch server connection details:
Enter Server Connection Address for the Elasticsearch server you set up earlier.
(Optional) Enter Server Username used to access the Elasticsearch server.
Note: For AWS Elasticsearch leave this field blank.
(Optional) Enter Server Password associated with the username.
Note: For AWS Elasticsearch leave this field blank.
Set Enable Cluster Sniffing (Optional). Sniffing finds and connects to all data nodes in your cluster automatically.
Note: For AWS Elasticsearch this field should be set to
Select Test Connection and Save the configuration.
If the server connection is unsuccessful you will not be able to save the configuration or enable searching with Elasticsearch.
Select Build Index to build the post index of existing posts.
This process can take up to a few hours depending on the size of the post database and number of messages. The progress percentage can be seen as the index is created. To avoid downtime set Enable Elasticsearch for search queries to
falseso that database search is available during the indexing process.
Enable Elasticsearch by setting Enable Elasticsearch for search queries to
Note: Complete bulk indexing before enabling Elasticsearch. Otherwise, search results will be incomplete. When this setting is
false, database search is used for all search queries.
Restart the Mattermost server.
Additional advanced Elasticsearch settings for large deployments can be configured outside the System Console in the
config.jsonfile. Read the documentation to learn more.
If your deployment has a large number of posts (typically in excess of one million but not strictly defined), the reindexing progress percentage may stay at 99% for a long time. The size of the data to be indexed is estimated, and on large databases, estimations can become inaccurate. While progress estimates may be inaccurate, and the progress percentage may appear stuck at near completion, indexing will continue behind the scenes until complete.
Search results for files shared before upgrading to Mattermost Server v5.35 may be incomplete until an extraction command is run using the CLI, or using the mmctl. After running this command, the search index must be rebuilt. Go to System Console > Environment > Elasticsearch > Bulk Indexing, then select Index Now to rebuild the search index to include older file contents.
Elasticsearch uses a standard selection of “stop words” to keep search results relevant. Results for the following words will not be returned: “a”, “an”, “and”, “are”, “as”, “at”, “be”, “but”, “by”, “for”, “if”, “in”, “into”, “is”, “it”, “no”, “not”, “of”, “on”, “or”, “such”, “that”, “the”, “their”, “then”, “there”, “these”, “they”, “this”, “to”, “was”, “will”, and “with”.
Searching stop words in quotes returns more results than just the searched terms (ticket).
AWS Elasticsearch implementations have a limit of 1000 days of post history that is searchable.
Search results are limited to a user’s team and channel membership. This is enforced by the Mattermost server. The entities are indexed in Elasticsearch in a way that allows Mattermost to filter them when querying, so the Mattermost server narrows down the results on every Elasticsearch request applying those filters.
The Elasticsearch engine is designed for large Enterprise deployments to run highly efficient database searches in a cluster environment. The default Mattermost database search starts to show performance degradation at around 2.5 million posts, depending on the specifications for the database server. If you expect your Mattermost server to have more than 2.5 million posts, we recommend using Elasticsearch for optimum search performance.
Mattermost creates three types of indexes: users, channels, and posts. Users and channels have one index each. Posts are aggregated by date, into multiple indexes.
The AggregatePostsAfterDays configuration setting defines a cutoff value. All posts preceding this value are reindexed and aggregated into new and bigger indexes. The default setting is 365 days.
The current implementation of Elasticsearch matches the search features currently available with database search. The Mattermost team is working on extending the Elasticsearch feature set with file name and content search, date filters, and operators and modifiers.
You can also refer to this article about Elasticsearch performance monitoring. It’s not written specifically for Prometheus, which Mattermost’s performance monitoring system uses, but has several tips and best practices.
There are a few possible reasons:
Querying the posts out of the database is resource limited (i.e., the machine the database is on is not powerful enough).
The Elasticsearch cluster is performance limited (i.e., the machines are not powerful enough).
The 25,000 messages are spread out over a long time window, and the
BulkIndexingTimeWindowSecondsconfiguration value is too low for efficient indexing of such a “sparse” database. The value of that config should ideally be set so that the median number of posts falling within any period of that time in the database is around 700 to 800. The default value is one hour, so if you are doing a lot less than 800 posts an hour on average, then the indexing will be much slower in terms of “posts per unit time”. This can be sped up by increasing that time window.
Mattermost communicates with Elasticsearch through its REST API using JSON messages for indexing and querying entities.
Every time a message is published, a channel is created, or a user changes, (either because their properties change e.g.: change of the first name or because they join/leave a channel), the data associated with that event is sent to Elasticsearch.
If search via Elasticsearch is enabled, every search will generate a query. If autocompletion is enabled, every user or channel autocompletion associated with writing a message or user search will generate a query.
Mattermost provides the status of each Elasticsearch indexing job in System Console > Environment > Elasticsearch. Here you can see if the job succeeded or failed, including the details of the error.
Failures are returned in the server logs. The error log begins with the string
Failed job and includes a job_id key/value pair. Elasticsearch job failures are identified with worker name
EnterpriseElasticsearchIndexer. You can optionally create a script that programmatically queries for such failures and notifies the appropriate system.
If you have an Elasticsearch indexing job that’s paused, it’s likely your Elasticsearch server has restarted. If you restart your Elasticsearch server, you must also restart Mattermost to ensure jobs are completed. If restarting the Mattermost server does not resolve the issue, please contact Mattermost support.