Apache Tika: Turn Business Documents into Searchable Text

Apache Tika detects file types and extracts text and metadata from over a thousand formats through one interface. A business gets searchable document content, cleaner intake and text it can feed to search or local AI. Skip a separate Tika service when you have only a handful of files, or your existing document system already indexes them well.

The useful first result is modest: someone searches an invoice number and finds the correct source PDF. The next result might be a queue of unreadable scans that need attention. Neither requires a chatbot.

Tika supplies a component your developer connects to the business workflow. It does not supply a document portal, decide who may read a lease, or verify an extracted total. You need a capable administrator for the parser and a developer for the connection to your records or search system.

We read the official documentation on October 30, 2026 and reuse the series cost research from October 29. We have not installed or benchmarked this setup. The examples, staffing, volumes and hours below are our planning assumptions, not customer results.

What goes between the document and the search box

Think of a document arriving at an intake desk. The intake program records where it came from and who can read it. Tika identifies its format, chooses a parser and returns content. Another program checks the result and sends approved fields to the index.

The downloads page lists 4.2.0, requiring Java 17 or newer, and the supported 3.3.3 line, requiring Java 11 or newer. Tika 4.x ships ZIP distributions containing a thin JAR and a lib directory. Moving only the JAR loses its dependencies. Older instructions that download one large runnable JAR describe a different packaging model.

The 4.2 command line guide documents tika-app; the server guide documents the HTTP service. Pick documentation for the release you install. In particular, 4.x configuration is JSON, and its default server text representation is Markdown. We request plain text explicitly below.

There are project maintained Docker images. The full flavor includes Tesseract and selected language packs; the minimal image does not provide the same OCR environment. Confirm an available release tag and pin its digest. We use the ZIP route because a generic latest tag does not establish which release or languages you received.

Metadata can include the detected media type, document title, creator and dates where the format provides them. These are document claims, not proof of authorship or a trustworthy filing date. A renamed file can still contain a different format, and a blank title can remain blank.

Language detection is a separate analysis of extracted text. Do not confuse it with choosing the OCR language pack: an engine needs to recognize the characters before a detector can read the resulting words. Very short labels, part numbers and multilingual pages need review.

Where the work pays off

Each illustration uses one extraction service and an existing source repository. The small service budget is $92 to $230 monthly plus $272 to $817 setup. The medium host budget is $116 to $254 monthly plus the same bounded setup allowance. Those figures include routine administration; scanning, integration, search hosting and document review are additional.

A six person accounting firm: “We have the client's statement, but nobody can find which upload contains it.” Its developer would extract approved client uploads into a private intake index, preserving client and tax year identifiers. Staff find the candidate file before opening it. Start with the small budget. Check the GLBA Safeguards Rule before handling client financial information; the FTC guidance explicitly includes tax preparation firms. An OCR amount must not post itself into the ledger.

An eight person law office: “The useful sentence is somewhere in this discovery folder.” It would parse a copied, matter restricted collection and return source references beside matches. A paralegal checks the original before quoting it. Use the medium budget for an initial batch, subject to measurement. Check attorney client confidentiality, applicable state professional rules and preservation duties before indexing or sending material to a provider. ABA Model Rule 1.6 is a reference point, not a substitute for the governing rules. Searchable text is not a complete discovery production.

A four person property manager: “Which signed lease mentions the parking space?” It would extract leases and amendments into a restricted index keyed to the tenancy. Staff see the signed document and its amendments together. Use the small budget; an extracted date becomes a review suggestion, never an automatic notice to a tenant. Keep applications and identity documents out of a general maintenance search.

A county clerk's five person office: “We can open the old minutes, but we cannot search the scanned years.” It would OCR an approved collection and link matches to the retained page images. Staff check names and motion wording before answering a request. Start with the medium budget for the backlog. Check state records retention and public records request rules, including exemptions, before making text public. If another department proposes law enforcement records, check CJIS requirements separately; that is outside this public minutes pilot.

A seven person insurance agency: “Which policy revision contains this endorsement?” Its developer would extract policy PDFs into a customer restricted collection with issue dates and revision identifiers. Staff open the actual endorsement before explaining coverage. Start with the small budget. Check the applicable GLBA safeguards obligations and insurance regulator rules before adding customer data. Health information also needs a HIPAA applicability review before it enters this workflow; a local server alone settles none of those questions.

A twenty person manufacturer: “The supplier changed the specification and we keep finding the old copy.” It would extract approved specification sheets, retain revision metadata and remove superseded results from the ordinary search view. The engineer checks the drawing before releasing work. Use the medium budget for a trial. OCR is especially risky around decimal points, tolerances and symbols; being able to search a number does not certify that number.

A three person nonprofit: “We wrote this answer in a grant application last year.” It would extract approved applications and award letters into a small archive, keeping beneficiary details in a separate restricted collection. Staff find earlier wording and check the current funding rules. Use the small budget, but compare the managed option first: at occasional volumes, operating another server is likely to cost more than the extraction calls.

OCR: the page image and the embedded text are different inputs

A PDF created by office software often contains selectable text. A scanned page may contain only an image. Some PDFs contain both, including an old OCR layer that is inaccurate. Test all three cases before choosing a default.

The TikaOCR wiki describes chaining Tesseract through TesseractOCRParser, installing the engine and adding language packs. It also describes older PDF settings for extracting inline images or rendering complete pages for OCR. Those operations differ: an embedded photograph may contain text, but extracting photographs alone does not reconstruct the whole page.

For 4.2, follow the current Tesseract configuration and PDF configuration. Tesseract is configured as a text recognition engine. PDF page text policies include EXTRACT, OCR, EXTRACT_AND_OCR and AUTO. Use EXTRACT for suitable embedded text, OCR to recognize rendered pages, and evaluate AUTO on mixed collections. Combining both can produce duplicate or conflicting text. Do not paste the wiki's older X-Tika-PDFOcrStrategy header into a 4.2 setup and assume it has the same meaning.

On an Ubuntu or Debian based evaluation server, the documented package route is:

sudo apt-get update
sudo apt-get install tesseract-ocr tesseract-ocr-eng
tesseract --version
tesseract --list-langs

Add only the language packs your sample needs, such as tesseract-ocr-fra for French. Tesseract's eng+fra language setting requires both packs. Run the checks as the service user too; an administrator finding a binary does not prove the service can execute it or read its language data.

Our suggested acceptance collection is 20 to 50 documents, an assumption: clean digital PDFs, faded scans, rotated pages, a multicolumn page, an email with an attachment and representative Office files. Include a handwritten note to expose a likely limitation. We make no handwriting accuracy promise for this Tesseract setup.

Compare output with the image for names, dates, amounts and unusual symbols. Record missing pages, broken reading order and empty output. A correct paragraph can hide a wrong total. Keep the source image available to the person reviewing a result.

OCR adds image rendering and recognition work. Its speed depends on resolution, page count, languages, page quality and CPU contention. We have no measured pages per minute to promise. Time the sample, record peak memory and scratch disk use, then measure a longer queue. Improving scan quality or using valid embedded text can be more useful than buying more CPUs.

Start one private server and extract a sample

This walkthrough is a bounded evaluation. Our small allowance is one 2 shared vCPU, 4 GiB RAM, 80 GiB disk server. The medium option is 4 shared vCPU, 8 GiB RAM, 160 GiB disk. These are the series hosting tiers, not Tika minimum requirements or throughput claims. OCR and nested attachments can exceed a small machine quickly.

First, create a separate unprivileged service account and a working area containing only synthetic test files. It must not have access to customer shares, cloud credentials or the backup encryption key. Have an administrator install a supported Java runtime satisfying Tika's Java 17 minimum. Check java -version from the account that will run it.

Next, get tika-server-standard-4.2.0.zip and its published verification material from the Apache download page. Verify the download using the linked checksum and signature instructions. Follow the server ZIP instructions, preserving the directory layout:

unzip -d tika-server-standard-4.2.0 tika-server-standard-4.2.0.zip
cd tika-server-standard-4.2.0
java -Xmx1536m -jar tika-server-standard-4.2.0.jar -p 9998

Run that command as the service account. The heap limit is our initial 1.5 GiB allowance, not a limit on every child process or Tesseract's memory. The kit adds a service manager configuration and the worker limits that need separate attention. Keep the server's default loopback binding for this first test. Do not change it to a wildcard address to make remote testing convenient.

In a second terminal on the same server, set TIKA_URL to the service's loopback HTTP URL including port 9998. Put a synthetic sample.pdf in that terminal's working directory. The endpoint documentation defines these requests:

read -r -p "Private Tika base URL, including port: " TIKA_URL
curl --fail --silent --show-error --max-time 120 \
  --upload-file sample.pdf "$TIKA_URL/tika/text" -o sample.txt
curl --fail --silent --show-error --max-time 120 \
  --upload-file sample.pdf -H 'Accept: application/json' \
  "$TIKA_URL/meta" -o sample-metadata.json
curl --fail --silent --show-error --max-time 120 \
  --upload-file sample.pdf -H 'Accept: application/json' \
  "$TIKA_URL/rmeta/text" -o sample-records.json

The first response is plain text. The second returns the container's metadata. The recursive endpoint returns a JSON list covering the container and supported embedded documents; in 4.2 its extracted content field is tk:content. That is useful for an email and its attachments. Keep parent and attachment identity rather than joining everything into an unexplained paragraph.

Open the results and compare them with the source. An HTTP success does not prove complete extraction. Inspect tk:exception:container-exception, tk:exception:embedded-exception and limit indicators. Put failures or truncated results into an exception queue. The curl timeout stops the client waiting; it does not establish that the parser process stopped.

Install Tesseract and the needed packs, then use the kit's 4.2 JSON OCR configuration with the server's -c option. Test an image only PDF whose expected phrase you know. If extraction is empty, check the service user's engine access, language data and selected PDF policy before increasing limits.

The Docker route is an alternative, not an additional requirement. The current documentation uses an unprivileged container user. Verify the actual image, restrict published interfaces, drop unnecessary capabilities and bound memory and processes. Installing Tesseract on the host does not put it inside a minimal container. The Docker installation guide is the starting point if Docker is not already maintained on your server.

For remote callers, prefer an approved private network. Alternatively, follow our Cloudflare Tunnel and Access guide: create and test the Access application before publishing its hostname, then point the tunnel at the loopback service. Machine callers need an appropriate service authentication policy. Test that direct inbound access cannot go around it. Cloudflare is then part of the document transit path; approve that data handling before sending sensitive files.

Send checked records to search, then consider AI

Your intake program should produce an application record containing a stable document identifier, approved source reference, detected type, extraction version, extraction status, text and permissions. Repository permissions come from the source system. A PDF's author metadata cannot tell you who may read it.

For Solr, have the developer map that record to the collection's explicit fields and submit it through the supported update interface. Save the source identifier so another extraction replaces the same record. Test deleting it and revoking access. The search article covers Solr's setup and Java 21 requirement for Solr 10; the search server and its interface are outside this article's extraction budget.

Start with keyword search. If semantic search helps real queries, the Solr dense vector guide documents DenseVectorField, vectorDimension and similarityFunction. Tika supplies text; a separately chosen embedding model supplies vectors. Match dimensions to that model and retain a way to rebuild after changing it.

A local answering model can receive authorized passages with source references. Keep extracted text as untrusted evidence: a document saying to ignore instructions must not gain control of tools or permissions. A person should be able to open the cited source and see why the answer was proposed. Our private document search guide follows that wider design.

ManifoldCF handles repository connections and permission information. OpenNLP can analyze the extracted language. Neither removes the need to check source permissions and bad OCR. Apache Answer remains a place for reviewed staff explanations; adding Tika does not make it a document chatbot automatically.

For a large backlog, examine Tika Pipes. Its fetch, parse and emit stages help organize batch work. Persist progress after each document and use stable identifiers for safe retries. Start with a small approved partition, keep a failed document list and limit concurrency. Never give a parser broad storage credentials merely because the batch controller needs them.

Security starts before the first upload

Tika parses untrusted file structures. Its security model calls for isolation, least privilege and control over network access. A password on the entrance does not make every client supplied document safe.

The security history includes CVE-2025-54988, an XML external entity issue in crafted PDF XFA content. Apache's CVE-2025-66516 record clarifies the affected core component: upgrading the PDF module while retaining an old vulnerable core is insufficient. The affected core range ends before 3.2.2. The history also includes older command execution and resource exhaustion defects. These are reasons to update the full dependency set and isolate parsing, not reasons to assume any current file is harmless.

Run Tika separately from the public application and valuable data. Restrict outbound network access, keep credentials out of its environment and provide bounded temporary storage. Set upload, recursion, extracted output, process and time limits. The 4.2 limits guide distinguishes worker timeouts from ordinary client timeouts. A rejected oversized file should remain visible as a failed job, not disappear from the intake count.

Never expose Tika directly to the public internet without authentication. Even behind authentication, restrict who can change parser settings or fetch destinations. Sanitize extracted output before displaying it as HTML. Keep confidential document text out of routine logs.

The 36 month bill

All prices are US dollars before tax. The series uses $68.09 per hour, derived from the BLS administrator wage of $47.66 divided by the 0.700 compensation wage share, rounded before multiplication. An outside provider's billable rate can be higher; get a quote.

DigitalOcean supplies the small $24 and medium $48 monthly caps, without an annual commitment discount. Backblaze B2 costs $6.95 per decimal TB monthly, with the first 10 GB free. Our retained backup range is 50 to 200 GB, including versions: max(0, GB minus 10) × $0.00695, or $0.278 to $1.3205 monthly. Apply the free allowance once; assume transfer and requests stay within included allowances.

Amazon Textract publishes an Oregon example for Detect Document Text at $0.0015 per page for the first million pages monthly. That means $15 for 10,000 pages or $150 for 100,000 pages. We exclude introductory credits. This compares basic text extraction from suitable documents, not forms, tables or invoice field recognition, which have different prices. Textract also does not replace Tika's broad Office and email parsing.

Our primary comparison assumes 10,000 pages monthly, one small Tika host, 4 to 12 setup hours and 1 to 3 administration hours monthly. For the managed route we assume 1 to 3 setup hours and 0.25 to 0.75 monthly hours for account, billing, access and recovery checks. Both retain the same backup allowance. These managed hours are our additional assumptions, not an AWS service promise.

Formula: setup hours × $68.09 + 36 × (host or page fee + backup + monthly admin hours × $68.09). Calculate before rounding to whole dollars. Tika's ongoing cost is approximately $0.00924 to $0.02296 per page at this volume, excluding setup. Its license fee is zero; its operating cost is not.

For a second scenario, assume 100,000 pages monthly and the medium host. Tika totals $4,462 to $9,946 over 36 months versus $6,091 to $7,490 managed with the same labor ranges. Tika saves $1,629 in the low case and costs $2,456 more in the high case. Low case break even is month 5: ceiling(($272.36 minus $68.09) / ($167.3005 minus $116.368)). High case never breaks even. This is conditional arithmetic, not evidence that one medium host processes that volume within your deadline.

Both sides exclude scanning labor, custom integration, OCR review, search and model hosting, migrations, compliance assessment, major incidents and extra storage or transfer charges. Managed input staging and any additional cloud services need separate prices. Setup month hosting is excluded on both sides. Managed extraction wins the small workload on cost, and can win larger work when its quality or burst handling reduces work your staff would otherwise do.

Setup time when Claude or ChatGPT does the typing

Keep the primary small server example. Our AI assumptions use 50% to 80% of manual setup hours and 75% to 100% of monthly administration hours. Prompting, review, testing and corrections are included. Within those totals, allow 1 to 3 setup review hours and 0.5 to 1.5 monthly review hours. These are planning assumptions; coding studies do not measure Tika deployment savings.

Claude Pro and ChatGPT Plus each cost $20 monthly in the October 29 research. Charge one separate setup month, then allocate $5 monthly for 36 operating months only if other work uses the remaining 75%. Sole use adds $540. Equal prices do not imply equal allowances; included coding access has limits.

Use AI total = S × q × L + T0 + 36 × (H + A × r × L + Tm): S and A are manual hours, q and r the AI shares, L the hourly rate, H unchanged hosting plus backups, and T0/Tm the tool fees.

Our cumulative API budgets are 200,000 to 1,000,000 setup input tokens and 20,000 to 100,000 output, including retries; monthly budgets are half those amounts. Low input is 30% ordinary, 10% short cache writes and 60% cache reads. High input is uncached. At the published Claude and OpenAI rates, setup/monthly fees are $0.764/$0.382 low and $6/$3 high for Opus, or $1.97/$0.985 and $15/$7.50 for Astra. The kit includes rates and arithmetic. These are setup tools, not an answering model budget.

Claude Code or Codex CLI can draft configuration and inspect failures. Desktop Commander can work on an authorized server or SSH session; the base estimate uses its free local server. Claude in Chrome can inspect provider and Access settings while a person watches. ChatGPT's cloud browser uses a separate browser; confirm availability before planning around it.

Use a new server, approve commands or restrict a sandbox, and never paste secrets or client documents into a setup conversation. Watch dashboard actions, review privileges and test restoration. Use subscriptions for supported supervised tools and API credentials for custom pipelines, as explained in our API and subscription guide. The person responsible still owns acceptance, updates and recovery. None of these AI scenarios makes Tika the cheaper small volume option.

Keep the originals and prove you can rebuild

Back up the source documents, extraction configuration, approved runtime versions, source identifiers, permissions and processing ledger. Retain derived text when reprocessing would take too long, but protect it like the originals. An index or OCR copy is not permission to discard the authoritative record.

Before an update, read the release notes and advisories, preserve the approved configuration and run the same sample through the candidate release. Compare text, metadata, attachment boundaries and failure reporting. Restore a sample and replay its intake record in an isolated environment. Check that a denied user still cannot retrieve its text.

Apache License 2.0 permits commercial use and modification subject to its terms, including distribution notices. It provides no warranty or blanket trademark permission. Review the license, dependency terms and ASF security guidance. Community help does not replace a named person who can repair Tuesday's failed intake.

The spending discipline in The $97 Launch fits this project: pay for a useful result you can check. Begin with a document someone failed to find, preserve its source, and make the next search return a result they can trust enough to inspect.

Download the kit

Download the Tika setup kit for the version checklist, private service template, OCR configuration, acceptance tests, first week plan and matching cost worksheet.

Related reading

• Apache search and knowledge tools for Answer, Solr, Nutch and the extraction pipeline.
• ManifoldCF and permission aware search and private document search with AI answers for the next components.
• Apache AI and OpenNLP for language analysis after extraction.
• An Apache stack for small and medium businesses and the Apache series hub for wider choices.
• AI API costs, guardrails and backups and a private VPS with Cloudflare Access for operating boundaries.

Fact-check notes and sources

Fresh reads are October 30, 2026, UTC. Shared price observations are October 29. Dates describe documentation checks, not installation results. Public source references below also identify the basis of the kit.

1. Tika downloads, October 30 at 00:27 UTC; supplied ordinary browser check October 29 and 30, exact time not recorded. Confirms “Tika 4.x ships zip distributions, not runnable jars.” Supported formats, supplied browser check on those dates, establishes the broad format scope; individual parser behavior remains version dependent.
2. 4.2 server, 00:29 UTC; CLI, 00:29; Docker, 00:28; Docker installation, 00:27. ZIP layout, endpoints and image choices.
3. TikaOCR, October 30 at 00:27 UTC; 4.2 OCR, PDF settings and language detection, 00:28. Older wiki syntax is not the 4.2 configuration format.
4. Pipes, 00:28; limits, 00:29; security model, 00:28; advisories, October 30 at 00:27 UTC; CVE-2025-66516, official CVE record read 00:29. Updating the core dependency matters.
5. Solr dense vector search, supplied ordinary browser observation October 29 and 30, exact time not recorded. Other component setup facts reuse the linked series articles.
6. Textract pricing, October 30 at 00:27:59 UTC. Its Oregon worked example states “$0.0015 for first 1 million.” Only basic text detection is priced here.
7. DigitalOcean and B2, October 29 at 21:10 UTC; BLS wage, 21:12; compensation share, 21:17. Reused series observations.
8. Claude subscription, October 29 at 23:31; ChatGPT subscription, ordinary browser observation about 23:27; Claude API and OpenAI API, 23:31. Standard synchronous prices; no credit deduction.
9. Codex CLI, October 30 at 00:27; Desktop Commander and its pricing, October 29 at 23:31; Claude in Chrome, 23:31; ChatGPT cloud browser, 23:32.
10. FTC Safeguards guidance, October 30 at 00:29; ABA Rule 1.6, 00:29. Applicability and governing rules need professional review before sensitive data is used.
11. Apache License 2.0 and ASF security, reused series observation October 29 at 21:40 UTC.

This post is informational, not legal, financial or security consulting advice.

Apache, the Apache feather logo and the Apache project names are trademarks of The Apache Software Foundation. This site is not affiliated with or endorsed by the ASF. Other product names are used for identification only.