System Design

Document Search

Design a document search service for a workspace like Google Drive or Confluence.

Functional requirements

• Users search their workspace's documents by keywords (e.g., 'q3 roadmap') and get a ranked page of results with title, a matching snippet, and last-modified date.
• Newly created or edited documents become searchable within a minute; deleted documents stop appearing.
• Results include only documents the searching user can open, honoring per-document and per-group sharing; sharing changes are reflected in search promptly.
• Title matches rank above body-only matches, and among comparable matches more recently edited documents rank higher.
• Support basic filters: owner, document type (doc, sheet, slide, PDF), and modified-date range.

Non-functional requirements

• Search latency: p99 under 300ms end to end (fan-out, merge, permission check, snippets) at peak load.
• Freshness is eventually consistent with a 60-second bound (a just-saved edit may take a minute to show); availability wins over completeness: if an index shard is slow or down, return results from healthy shards marked partial rather than failing.
• Security: a result must never expose a document the user cannot open, including its title or snippet; a document whose sharing is revoked disappears from that user's results within 60 seconds.
• Durability: the index is derived and rebuildable from the document store, but pending index updates must never be lost (a lost event leaves a document unsearchable until its next edit).
• Multi-tenant isolation: one workspace's documents never appear in another's results, and a tenant's bulk import must not push others past the freshness bound.

Scaling & constraints

• 50,000 workspaces and 2B documents in total, growing ~3% per month; the largest tenant has 40M documents, the median has 5,000.
• Ingest: 3,000 create/edit/delete events per second on average, 15,000/sec at peak; a single bulk import can push 2M documents in an hour.
• Search: 20,000 queries per second at peak (about 7:1 reads to writes); queries average 2.3 terms and 80% are satisfied by the first page of 10.
• Documents average 15 KB of extractable text (~600 distinct terms), with a tail up to 5 MB; the inverted index runs ~25% of raw text, so ~7.5 TB before replication.
• Permissions: a document is shared with ~8 principals (users or groups); groups nest 5 levels deep, the largest has 200,000 members; sharing changes arrive at ~500/sec and one group change can touch 1M documents.
• Skew: the top 1% of tenants generate ~60% of queries; 'meeting' appears in ~40% of a tenant's documents, the median query term in under 0.1%.

Out of scope

• Document storage, editing, and the document content APIs themselves.
• Prefix typeahead and query suggestions (a separate autocomplete service exists).
• Semantic or vector search, OCR, and language analysis beyond tokenization and stemming.
• User and group management (assume a directory service exposes group membership).