What is a refresh and a flush in Elasticsearch?
Understand refresh vs flush in Elasticsearch: how refresh makes documents searchable, how flush commits data to disk, and the role of the translog.
Expected Interview Answer
A refresh makes recently indexed documents visible to search by turning the in-memory buffer into a searchable Lucene segment, while a flush durably persists those changes to disk and clears the translog. Refresh controls search visibility; flush controls durability.
When you index a document it lands in an in-memory buffer and is appended to the translog for crash recovery. A refresh (default every 1 second) writes the buffer to a new segment held in the OS filesystem cache, making the document searchable but not yet fsynced. A flush performs a Lucene commit that fsyncs the segments to disk and truncates the translog, so on restart Elasticsearch does not have to replay it. Refresh is cheap and frequent; flush is heavier and less frequent, usually triggered automatically by translog size or age.
- Refresh gives near-real-time search without a full disk commit
- Flush guarantees durability and bounds recovery time
- The translog protects un-flushed data against crashes
- Refresh interval is tunable for indexing-heavy workloads
- Separating visibility from durability keeps indexing fast
AI Mentor Explanation
Refresh is the scoreboard operator updating the visible score right after each ball so spectators see it, even though the official scorebook is not yet signed. Flush is the scorer formally writing and signing the innings into the permanent record book at the interval, so if the power fails the totals survive. One makes runs visible quickly; the other makes them permanent and recoverable.
Step-by-Step Explanation
Step 1
Index into the buffer
New documents go into an in-memory indexing buffer and are appended to the translog for crash recovery.
Step 2
Refresh to a segment
A refresh writes the buffer into a new in-memory Lucene segment in the OS cache, making documents searchable.
Step 3
Serve searches
Queries now see the new segment; the data is visible but not yet fsynced to disk.
Step 4
Flush and commit
A flush runs a Lucene commit, fsyncing segments to disk so they survive restarts.
Step 5
Truncate the translog
After a successful flush the translog is cleared, because its operations are now safely on disk.
What Interviewer Expects
- Clear distinction between search visibility and durability
- Understanding of the in-memory buffer and Lucene segments
- Role of the translog in crash recovery
- Knowledge of default refresh interval and how to tune it
- Awareness that flush is usually automatic based on translog size
Common Mistakes
- Thinking a refresh writes data safely to disk
- Confusing flush with force-merge of segments
- Believing every indexed document is instantly searchable
- Ignoring the translog's role in durability between flushes
- Setting refresh_interval too low on heavy indexing workloads
Best Answer (HR Friendly)
“A refresh makes newly added data show up in search results quickly, while a flush makes sure that data is safely written to disk so nothing is lost if the server restarts. One is about seeing data fast, the other is about keeping it safe.”
Code Example
# Make recent changes searchable immediately
POST /products/_refresh
# Durably commit segments to disk and clear the translog
POST /products/_flush
# Slow down refreshes on a heavy bulk-indexing job
PUT /products/_settings
{
"index": { "refresh_interval": "30s" }
}Follow-up Questions
- What is the translog and why is it needed?
- How does refresh_interval affect indexing throughput?
- What is the difference between flush and force-merge?
- Why can setting refresh_interval to -1 speed up bulk loads?
- How does Elasticsearch achieve near-real-time search?
MCQ Practice
1. What does a refresh primarily do in Elasticsearch?
A refresh turns the in-memory buffer into a searchable segment, making new documents visible without a disk commit.
2. What is cleared after a successful flush?
A flush performs a Lucene commit and then truncates the translog because its operations are now durable on disk.
3. What protects un-flushed data against a node crash?
Operations are appended to the translog so they can be replayed after a crash before the next flush.
Flash Cards
What does refresh control? — Search visibility — it makes recently indexed documents searchable via a new segment.
What does flush control? — Durability — it fsyncs segments to disk with a Lucene commit and truncates the translog.
Default refresh interval? — 1 second, which is why Elasticsearch offers near-real-time search.
Purpose of the translog? — It records operations so un-flushed data can be replayed and recovered after a crash.