The 30 second answer
Instead of storing each document's words, an inverted index maps each term to the documents that contain it, often with frequencies and positions. A query looks up its terms and combines their postings lists instead of scanning documents. Lucene writes it as immutable segments, each with a terms dictionary, postings, stored fields, doc values and a live-documents file for deletes.
The idea. A forward index lists the terms in each document. An inverted index flips it: for every term, a postings list of the documents that contain it, sorted by document ID, usually with term frequency and optionally positions and offsets. Building it means analysing text into terms, then grouping postings by term. Introduction to Information Retrieval describes this as a dictionary of terms plus postings lists, with the dictionary kept in memory and postings on disk.
In Lucene. The index file-format documentation describes an index as a set of segments, each a self-contained index. Each segment holds, among other files:
- Term dictionary and term index (
.tim,.tip): the terms and an in-memory index into them. - Postings (
.doc,.pos,.pay): document IDs with frequencies, positions and payloads, encoded in packed integer blocks for fast decoding. - Stored fields (
.fdt,.fdx): the original values returned in results. - Doc values: a column-oriented copy of fields for sorting and aggregations, which the inverted index is bad at.
- Points and vectors: structures for numeric ranges and for kNN search.
- Live documents (
.liv): which documents in the segment are still live after deletes.
Why both an inverted index and doc values. Matching needs term to documents; sorting by price or counting facets needs document to value. That is why Elasticsearch maps text both as a text field for matching and often as a keyword field with doc values for aggregations.
Alternate interview scenarios
"Search for a red linen dress. Walk me through what happens inside one shard." The query is analysed with the field's search analyzer into terms such as red, linen and dress. Each term is looked up in the terms dictionary, which gives a pointer into its postings. The engine walks the postings, intersecting or unioning them according to the Boolean query, scores matching documents, keeps the top hits, and returns them to the coordinating node, which merges results from all shards and then fetches stored fields for the final page.