ElasticSearch ElasticSearch Indexing & Data Management 2 — Questions and Answers
Question 1: What does the 'delete by query' API do in Elasticsearch?
- Deletes an entire index matching a name pattern
- Deletes all documents matching a specified query (Correct answer)
- Removes a field from all documents
- Deletes unused index segments
Correct answer: Deletes all documents matching a specified query
The delete by query API deletes all documents in an index that match a given query, operating on a snapshot of the data at query time.
Question 2: What is the purpose of the 'shrink' API in Elasticsearch?
- Compressing index data to save disk space
- Reducing the number of primary shards in an index (Correct answer)
- Merging all segments into one
- Decreasing the replica count
Correct answer: Reducing the number of primary shards in an index
The shrink API allows you to reduce the number of primary shards in an index, which is useful after data becomes less active and fewer shards are needed.
Question 3: What is 'rollover' in the context of Elasticsearch index management?
- Restoring a snapshot to a new index
- Automatically creating a new index when the current one meets specified conditions like size or age (Correct answer)
- Rolling back failed index operations
- Migrating an index to a different tier
Correct answer: Automatically creating a new index when the current one meets specified conditions like size or age
Rollover creates a new write index when the current index meets specified conditions such as maximum document count, index size, or age.
Question 4: What is the Elasticsearch 'snapshot' feature used for?
- Taking real-time screenshots of Kibana dashboards
- Creating backups of indices or entire clusters to remote storage (Correct answer)
- Capturing the current cluster state for debugging
- Freezing an index for read-only access
Correct answer: Creating backups of indices or entire clusters to remote storage
The snapshot API creates backups of individual indices or entire clusters to a remote repository such as S3, GCS, or a shared filesystem.
Question 5: What does 'field data' refer to in Elasticsearch?
- The raw bytes stored in a document field
- An in-memory data structure used for sorting and aggregations on text fields (Correct answer)
- The analyzer applied to a field
- The number of documents containing a specific field
Correct answer: An in-memory data structure used for sorting and aggregations on text fields
Field data is an in-memory data structure Elasticsearch builds on demand to support sorting and aggregations on analyzed text fields, though it can be memory-intensive.
Question 6: What are 'doc values' in Elasticsearch?
- The default value assigned to a field when it is missing
- An on-disk columnar data structure that supports sorting, aggregations, and scripting efficiently (Correct answer)
- The total number of documents indexed per day
- The stored source of a document
Correct answer: An on-disk columnar data structure that supports sorting, aggregations, and scripting efficiently
Doc values are an on-disk, columnar data structure built at index time that enables efficient sorting, aggregations, and access in scripts without loading data into memory.
ElasticSearch ElasticSearch Indexing & Data Management 2
What does the 'delete by query' API do in Elasticsearch?