Elasticsearch test (Intermediate)

Sample questions

5 sample questions from the Elasticsearch test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which of the following correctly describes how the `terms` aggregation works in Elasticsearch with respect to memory usage and bucketing precision?

   1. The `terms` aggregation uses doc values for exact bucketing and avoids high memory usage by default.
   2. The `terms` aggregation uses HyperLogLog++ for exact bucketing and avoids high memory usage by default.
   3. The `terms` aggregation uses field data for exact bucketing and may consume high memory by default.
   4. The `terms` aggregation uses doc values for approximate bucketing and avoids high memory usage by default.

   Answer: A. The `terms` aggregation uses doc values for exact bucketing and avoids high memory usage by default.

   The `terms` aggregation uses doc values for exact bucketing and avoids high memory usage by default. This is because doc values are columnar, on-disk structures that are efficient for aggregation operations. The `cardinality` aggregation, on the other hand, uses HyperLogLog++ to approximate distinct counts. The `terms` aggregation can be configured with `size` to control the number of buckets returned and can be paginated with `composite` for large result sets. The other options are either incorrect or describe different aggregations.

2. What will happen when executing the following Elasticsearch query on a 'text' field that was indexed using the 'standard' analyzer? `GET index/_search { 'query': { 'term': { 'text_field': 'Quick' } } }`

   1. The query will return all documents where the 'text' field contains the exact word 'Quick'.
   2. The query will return no results because the 'term' query does not analyze the input text, and the indexed tokens are lowercase.
   3. The query will return all documents where the 'text' field contains the word 'quick' in lowercase.
   4. The query will return an error because 'term' queries are not supported for 'text' fields.

   Answer: B. The query will return no results because the 'term' query does not analyze the input text, and the indexed tokens are lowercase.

   The 'term' query performs an exact match on the indexed terms, without any analysis. Since the 'text' field is analyzed using the 'standard' analyzer, the input text 'Quick' is indexed as 'quick' (lowercase). The 'term' query for 'Quick' does not match 'quick', so no documents are returned.

3. What is the correct approach for changing the type of an existing field in Elasticsearch?

   1. The field type can be changed by deleting the old index and creating a new one with the same name.
   2. The field type cannot be changed once defined; a new index must be created and data reindexed.
   3. The field type can be changed using a reindex API without creating a new index.
   4. The field type can be changed directly using an update mapping API.

   Answer: B. The field type cannot be changed once defined; a new index must be created and data reindexed.

   In Elasticsearch, once a field's type is defined in the mapping, it cannot be changed. To modify the field type, a new index must be created with the updated mapping, and data must be reindexed from the old index to the new one. This ensures data consistency and avoids potential mapping conflicts.

4. What happens when a `term` query is executed on a `text` field with the input 'Quick'?

   1. A `term` query on a `text` field with 'Quick' will return partial matches due to the default analyzer.
   2. A `term` query on a `text` field with 'Quick' finds matches because Elasticsearch is case-insensitive by default.
   3. A `term` query on a `text` field with 'Quick' will find all documents that contain 'Quick' in uppercase.
   4. A `term` query on a `text` field with 'Quick' finds nothing because indexed tokens are lowercase.

   Answer: D. A `term` query on a `text` field with 'Quick' finds nothing because indexed tokens are lowercase.

   Elasticsearch's `term` query is used for exact matches and does not perform analysis on the input. When applied to a `text` field, the query looks for the exact term in the index, but the `text` field is analyzed during indexing, which means terms are stored in lowercase by default. Thus, a `term` query for 'Quick' will not find any matches because the indexed term is 'quick'.

5. Which of the following is true about replica shard management in Elasticsearch?

   1. Replica shards cannot be modified once the index is created.
   2. Replica shards must be reindexed to change their number.
   3. Replica shards are fixed at the time of index creation and cannot be changed.
   4. Replica shards can be added or removed at any time without reindexing the data.

   Answer: D. Replica shards can be added or removed at any time without reindexing the data.

   In Elasticsearch, replica shards are designed to be flexible and can be added or removed dynamically without requiring a reindexing operation. This allows for easy scaling and maintenance of the cluster's performance and redundancy. Primary shards, on the other hand, are fixed at the time of index creation and cannot be changed without reindexing, which is a more involved process.