How Tencent Scales Elasticsearch for Billions of Queries: Challenges & Optimizations

1. ES Application Scenarios

Inside Tencent, Elasticsearch is used for real‑time log analysis, search services, and time‑series data analysis. Typical log types include operation logs, business logs, and audit logs.

2. Industry Application Scenarios

In e‑commerce platforms, ES powers product search, app‑store search, and site‑wide search, handling tens of thousands of QPS with sub‑20 ms latency.

3. Challenges

Large‑scale, high‑pressure workloads expose two main challenge groups: search‑oriented (high availability, high performance) and time‑series‑oriented (cost, performance, storage).

4. ES Optimization Practices

Tencent improves high availability by strengthening system robustness, disaster‑recovery, and fixing kernel defects. Optimizations include:

System robustness: fault tolerance under abnormal queries, scalability under pressure, and balanced shard distribution.

Disaster‑recovery: multi‑AZ deployment, backup‑restore to cheap storage, and fast failure recovery.

Kernel fixes: master‑node blocking, distributed deadlock, rolling‑restart acceleration.

Four‑level rate limiting (permission, queue, memory, multi‑tenant) and aggregation bucket control.

Shard‑allocation algorithm, cold‑data auto‑merge, and time‑aware merge for time‑series data.

Cost‑saving techniques such as hot‑cold separation, pre‑computation, cheap storage backup, and cache optimization.

Write, CPU, and query optimizations that raise write throughput by up to 45 % and cut query latency by 30 %.

5. Future Plans & Open‑Source Contribution

Tencent continues to contribute more than ten PRs to the Elasticsearch project, focusing on write, query, and cluster management, and plans to explore data‑engineering, data‑discovery, and data‑apps directions.