ElasticSearch Cheat Sheet 2026

The 30 highest-yield ElasticSearch facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which Elasticsearch feature helps assess the risk of a query returning stale data after a primary shard failover? → The _seq_no and _primary_term fields for optimistic concurrency control
2. What happens when cluster.routing.allocation.enable is set to 'none' in Elasticsearch? → All shard allocations are disabled, preventing any new shard assignments
3. An Index may be divided into several → Shards
4. Which API is used to check the health of an Elasticsearch cluster? → GET /_cluster/health
5. A real-estate app needs to find all properties within 10 km of a user's location. Which Elasticsearch query should be used? → Geo distance query
6. What does the Elasticsearch 'explain' API parameter do? → Shows why a document matched or didn't match and its relevance score
7. Which Elasticsearch configuration helps QA teams ensure that no single bulk request can consume excessive heap and destabilize the cluster? → http.max_content_length
8. What does the 'profile' API in Elasticsearch help with? → Detailed timing breakdown of query and aggregation execution
9. What does the 'update by query' API do in Elasticsearch? → Updates all documents that match a query using a script or partial update
10. A financial services firm ingests trade data and needs near-real-time aggregations with minimal indexing latency. Which refresh strategy best meets this need? → Keep default 1s refresh interval
11. What is the 'explain' API in Elasticsearch used for? → Showing how a relevance score was calculated for a specific document
12. What is the default number of primary shards per index in Elasticsearch 7.x and later? → 1
13. Which Elasticsearch feature allows you to receive alerts before a security threat causes data loss? → Watcher
14. Why is documentation important in ElasticSearch risk management? → It creates an audit trail, supports decision-making, and demonstrates due diligence
15. What is the default behavior of Elasticsearch when you index a document with an existing ID? → It fully replaces the existing document and increments the version
16. What Elasticsearch abstraction allows you to point multiple indices under a single name for transparent index management? → Alias
17. What is the primary risk of enabling dynamic mapping in a production Elasticsearch index? → Unintended field type inference can cause mapping explosions and query failures
18. Which programming language was Elasticsearch written in? → Java
19. The replica shard is a copy of the original shard. → Primary
20. What is the professional standard for managing Elasticsearch credentials used by application services? → Store credentials in a secrets manager and rotate them on a defined schedule
21. What does the Elasticsearch 'highlight' feature do? → Returns snippets of matched text with search terms highlighted
22. In Elasticsearch, what is the 'split brain' problem? → When network partition causes multiple nodes to independently elect themselves as master
23. What does the `doc_values` field mapping parameter control in Elasticsearch? → On-disk data structures used for sorting and aggregations
24. The default communication port for Elasticsearch is → 9300/tcp
25. What is the role of a 'master-eligible' node in an Elasticsearch cluster? → To participate in master election and manage cluster state
26. Which Elasticsearch query type is best for full-text search on analyzed fields? → match query
27. What is the default number of primary shards for an index created in Elasticsearch 7.x and later? → 1
28. A content platform needs to prevent adult content from appearing in searches for users who have safe-search enabled. What is the cleanest implementation? → Use index aliases with a filter on adult_content=false for safe-search users
29. What does the 'size' parameter control in an Elasticsearch search request? → The maximum number of hits returned in the response
30. Which approach best demonstrates professional competency in ElasticSearch practice? → Integrating continuing education, practical experience, and evidence-based decision making