Elasticsearch

10 units, 26 lessons and 48 questions on Elasticsearch. Includes a full-length Elasticsearch 8.15 mock exam drawn in the published domain weights, marked with a per-domain breakdown. Free, and open without an account.

The exam it prepares for: Elastic Certified Engineer (Elasticsearch 8.15), pass Not published; the exam is hands-on, not multiple choice.

What is in it

Documents and indices

The two nouns everything else is built from.

  • What you are actually storing — A document is a JSON object with an id. An index is a named collection of documents that share a mapping. There are no rows and no joins waiting for you.
  • Reading and writing a document — Index, get, update and delete. Updates are not in place: the old document is marked deleted and a new one is written.
  • Bulk, and why single writes hurt — The _bulk API batches many operations into one request. Indexing documents one at a time is the most common reason a load job crawls.

Mappings and field types

The decision you cannot take back without reindexing.

  • text against keyword — text is analyzed and searchable by words. keyword is stored whole and is what you sort, filter and aggregate on. Choosing wrong is the single commonest Elasticsearch mistake.
  • Dynamic mapping and what it guesses — With no mapping, Elasticsearch infers types from the first document it sees. It guesses well enough to get started and badly enough to hurt later.
  • Index templates — Templates apply a mapping to indices whose names match a pattern, which is how time-series indices get a consistent shape without anyone remembering to set it.

Analysis

What happens to your text before it is stored, and to your query before it is matched.

  • The three stages — An analyzer is character filters, then one tokenizer, then token filters. The same analyzer normally runs on the text at index time and on your query at search time.
  • Testing an analyzer before you trust it — The _analyze API shows the exact tokens a piece of text produces. It answers "why does this document not match" faster than reading any documentation.
  • Keyword fields are not analyzed — A keyword field skips analysis entirely. That is the point of it, and it is why a keyword search is case-sensitive unless you normalise it.

Query DSL

Asking the right question, and knowing which parts of it cost you.

  • match against term — match analyzes what you give it. term does not. Sending a term query at a text field is the second commonest mistake after mistyping a field.
  • bool, and its four clauses — must and should affect the score. filter and must_not do not — they only include or exclude, and their results can be cached.
  • Relevance, briefly — Scores come from how rare a term is and how often it appears in the document. They are comparable within one result set and meaningless between two different queries.

Aggregations

Counting, grouping and summarising without pulling the documents out.

  • Buckets and metrics — Bucket aggregations group documents — terms, date_histogram, range. Metric aggregations compute a number over a group — avg, sum, max, cardinality.
  • terms is approximate, and says so — On a sharded index a terms aggregation asks each shard for its own top values and merges them. The counts can be slightly wrong, and the response tells you by how much.

Shards and the cluster

Where the data physically is, and what breaks when a node leaves.

  • Primaries and replicas — An index is split into primary shards, each of which may have replicas. Primaries take writes; replicas serve reads and take over if a primary is lost.
  • Reading cluster health — Green: everything assigned. Yellow: every primary is assigned but some replica is not. Red: at least one primary is missing, and data is unavailable.
  • Too many shards — Every shard is a Lucene index with its own overhead. Hundreds of tiny shards cost more than a few right-sized ones, and the damage shows up as slow cluster state updates rather than slow queries.

Running it

Aliases, reindexing and getting old data off expensive disks.

  • Aliases — An alias is a name that points at one or more indices and can be repointed atomically. Applications should read through an alias, never an index name.
  • Reindexing — The _reindex API copies documents from one index into another, optionally transforming them on the way. It is the standard answer to "the mapping is wrong".
  • Index lifecycle — ILM moves an index through hot, warm, cold and frozen phases and eventually deletes it, so that data nobody queries stops occupying fast disks.

Exam topics · Data management

Indices, mappings, aliases, data streams and index lifecycle management. The exam is hands-on: treat these questions as a check on the ideas, then do the same thing on a real cluster.

  • Mappings, and why they cannot be changed — A field mapping is fixed once data is indexed against it. Adding a field is fine; changing a type means reindexing into a new index, which is why aliases are set up before they are needed.
  • Data streams, ILM and snapshots — A data stream is append-only time series data behind one name, rolling over to new backing indices. ILM moves indices through hot, warm, cold, frozen and delete. Snapshots go to a registered repository.

Exam topics · Searching and aggregating

Query DSL, the difference between query and filter context, and the aggregation types. The largest part of a working day with Elasticsearch.

  • Query context and filter context — A query in query context scores; in filter context it only matches, and the result is cacheable. bool takes must, should, filter and must_not — the last two are filter context.
  • Aggregations — Metric aggregations compute a number; bucket aggregations group documents; pipeline aggregations work on the output of another aggregation. Nesting a metric inside a bucket is the everyday pattern.

Exam topics · Cluster management and processing

Shard allocation, cluster health, node roles, ingest pipelines and troubleshooting — the tasks that decide whether the cluster stays up.

  • Cluster health and shard allocation — Yellow means all primaries are assigned but some replicas are not; red means a primary is missing. The allocation explain API says why, and it is almost always disk watermarks, node attributes or too few nodes.
  • Ingest pipelines and analysis — An ingest pipeline transforms a document before it is indexed, with processors such as grok, set, rename and script. An analyzer decides how text becomes tokens: character filters, a tokenizer, then token filters.

Open the Elasticsearch course · sit the Elasticsearch 8.15 mock exam · try 10 practice questions first