ElasticSearch Case Studies & Practical Application 2 — Questions and Answers
Question 1: An e-commerce platform needs to autocomplete product names as users type. Which Elasticsearch feature is best suited for this use case?
- Term-level query with wildcard
- Completion suggester with edge n-gram tokenizer
- Match phrase prefix query (Correct answer)
- Fuzzy query with boost
Correct answer: Match phrase prefix query
Match phrase prefix query efficiently handles prefix-based autocomplete by matching documents where the last term is treated as a prefix.
Question 2: A healthcare company stores patient records and needs to ensure that a doctor's query only returns records for their assigned patients. Which Elasticsearch mechanism should be used?
- Index-level access control
- Document-level security with role-based queries (Correct answer)
- Field-level encryption
- Separate indices per doctor
Correct answer: Document-level security with role-based queries
Document-level security allows role-based queries that filter which documents a user can retrieve, enforcing per-user data boundaries.
Question 3: A news website indexes thousands of articles per hour. Queries are slow because the index has too many small shards. What is the recommended remedy?
- Add more replica shards
- Use shrink API to reduce shard count (Correct answer)
- Delete old indices manually
- Increase refresh interval to 60s
Correct answer: Use shrink API to reduce shard count
The Shrink API consolidates many small shards into fewer larger shards, reducing overhead and improving query throughput.
Question 4: A SaaS company runs multi-tenant search where each tenant has unpredictable data volume. Which indexing strategy best balances isolation and resource efficiency?
- One index per tenant with fixed shard count
- A shared index with a tenant_id field and routing (Correct answer)
- Separate clusters per tenant
- One alias per tenant pointing to the same index
Correct answer: A shared index with a tenant_id field and routing
A shared index with a tenant_id field and custom routing keeps tenant data co-located on specific shards, balancing isolation with resource efficiency.
Question 5: An application logs millions of IoT sensor events daily. Users only query the last 7 days of data. What ILM policy action should be applied to data older than 7 days?
- Force merge to 1 segment
- Rollover to a new index
- Delete the index
- Move to frozen tier (Correct answer)
Correct answer: Move to frozen tier
The frozen tier stores indices on cheaper storage and unmounts them from heap, making old data queryable on demand without wasting resources.
Question 6: A legal firm needs full-text search over scanned PDF documents. They convert PDFs to text and index them. Very long documents cause mapping errors. What setting resolves this?
- Increase max_result_window
- Set ignore_above on the keyword sub-field
- Increase index.highlight.max_analyzed_offset (Correct answer)
- Set index_options to offsets
Correct answer: Increase index.highlight.max_analyzed_offset
index.highlight.max_analyzed_offset raises the character limit Elasticsearch will analyze per field, preventing errors on very long text when highlighting.
Question 7: A retail company wants to boost search results for in-stock products without excluding out-of-stock items. Which query approach achieves this?
- Filter clause to exclude out-of-stock
- Must clause requiring in_stock=true
- Function score with a filter boost on in_stock=true (Correct answer)
- Should clause with minimum_should_match=1
Correct answer: Function score with a filter boost on in_stock=true
Function score with a filter boost multiplies the score of matching in-stock documents while still returning out-of-stock items at lower scores.
ElasticSearch Case Studies & Practical Application 2
An e-commerce platform needs to autocomplete product names as users type.
Which Elasticsearch feature is best suited for this use case?