Elasticsearch

Elasticsearch is a distributed, JSON-document oriented search and analytics engine, scalable data store, and vector database. It is built on top of Apache Lucene and exposes its functionality over a REST API, the binary transport protocol, and language clients. The project is the foundation of the broader Elastic Stack and powers full-text search, vector search, log/metric/APM analytics, security analytics, and Retrieval Augmented Generation (RAG) workloads.

What this wiki covers

This wiki is generated from the source tree at https://github.com/elastic/elasticsearch. It is intended for engineers who need to find, read, or change Elasticsearch source code. It is not a user manual — for end-user documentation see elastic.co/guide.

Repository at a glance

• Language: Java (JDK 25 toolchain) with small amounts of Groovy, shell, and Python in the build.
• Build: Gradle composite build (build-conventions, build-tools, build-tools-internal).
• Source size: ~28,900 Java files and ~5.7M lines of Java code across server, modules, plugins, libs, qa, and x-pack.
• Active development: 99,000+ commits since Feb 2010; ~3,900 commits in the last 90 days from ~340 contributors per year.
• License: Trinitarian — Elastic License 2.0 / SSPL 1 / AGPL v3 for default code; Elastic License 2.0 only for x-pack/.

High-level layout

server/                     Core Elasticsearch server (action layer, cluster, indices, search, transport, REST)
modules/                    Built-in modules shipped with the default distribution
plugins/                    Officially-supported optional plugins (analysis, mappers, repositories)
libs/                       Internal libraries reused across server and plugins
x-pack/plugin/              Commercial features (ESQL, ML, security, ILM, watcher, transforms, snapshots, ...)
qa/                         Integration and multi-version test suites
docs/                       Asciidoc reference documentation (separate from this wiki)
distribution/               Packaging logic (archives, Docker, DEB/RPM, Windows MSI)
build-conventions/          Shared Gradle conventions
build-tools/                Public Gradle plugins for building Elasticsearch and plugins
build-tools-internal/       Internal-only Gradle plugins, tasks, and tooling
benchmarks/                 JMH micro-benchmarks
client/                     Test clients used by integration tests
rest-api-spec/              JSON spec for REST endpoints (used by client codegen and YAML REST tests)

How the pieces fit

A running Elasticsearch process is a single Node (server/src/main/java/org/elasticsearch/node/Node.java) that wires together a set of services through a Guice-based Injector:

• REST layer (server/src/main/java/org/elasticsearch/rest) translates HTTP requests into transport actions.
• Transport layer (server/src/main/java/org/elasticsearch/transport) routes actions between nodes using a custom binary protocol over Netty.
• Cluster state (server/src/main/java/org/elasticsearch/cluster) is a strongly-consistent metadata document maintained by the master via the Coordinator.
• Indices (server/src/main/java/org/elasticsearch/indices, .../index) own the per-shard Lucene IndexWriter/Searcher and the engine that manages refreshes, flushes, merges, and translog.
• Search (server/src/main/java/org/elasticsearch/search) executes queries across shards in two-phase (query then fetch) fashion.
• Plugins (server/src/main/java/org/elasticsearch/plugins) extend the node with extra mappers, analyzers, REST handlers, repositories, ML inference, etc.

For a full picture, read Architecture.

Where to start as a contributor

• New to the codebase? Read Getting started, then skim the Glossary.
• Picking up an issue? See How to contribute and Development workflow.
• Working on search? Start with the Search system page and the Aggregations feature.
• Working on ESQL, ML, security, or ILM? Jump to X-Pack overview.
• Looking for cross-cutting code patterns (transport actions, listeners, threading)? See Patterns and conventions.