ElasticSearch Case Studies & Practical Application 3 — Questions and Answers
Question 1: A financial services firm ingests trade data and needs near-real-time aggregations with minimal indexing latency. Which refresh strategy best meets this need?
- Set refresh_interval to -1 to disable
- Keep default 1s refresh interval (Correct answer)
- Set refresh_interval to 30s and call _refresh via API after bulk loads
- Use index.translog.durability=async
Correct answer: Keep default 1s refresh interval
The default 1-second refresh interval provides near-real-time visibility into indexed documents without requiring manual refresh calls.
Question 2: A cybersecurity platform ingests firewall logs and needs to detect the same IP appearing in more than 100 events within 5 minutes. Which Elasticsearch feature handles this?
- Percolator queries
- Watcher with a bucket aggregation alert condition (Correct answer)
- Transform with continuous mode
- Enrich processor in an ingest pipeline
Correct answer: Watcher with a bucket aggregation alert condition
Watcher can run scheduled searches with bucket aggregation conditions, triggering alerts when a bucket (e.g., an IP) exceeds a defined threshold.
Question 3: A travel app indexes hotel listings. Users searching 'NYC hotels' get poor results because the index uses the default analyzer on the city field. What is the best fix?
- Change city field to keyword type
- Apply a synonym token filter mapping 'NYC' to 'New York City' (Correct answer)
- Use a wildcard query on city
- Index city as a nested object
Correct answer: Apply a synonym token filter mapping 'NYC' to 'New York City'
A synonym token filter at index or query time expands 'NYC' to 'New York City', improving recall for abbreviated city names.
Question 4: A streaming media company wants to recommend content based on a user's watch history stored in Elasticsearch. Which query finds documents similar to a given document?
- More Like This (MLT) query (Correct answer)
- Percolate query
- Rank feature query
- Span near query
Correct answer: More Like This (MLT) query
The More Like This query finds documents that share significant terms with a reference document, making it suitable for content-based recommendations.
Question 5: An online marketplace indexes product listings from multiple sellers. A seller's products should always appear first in their own storefront search. What technique achieves this?
- Index boost on the seller's index
- Script score query adding a fixed boost when seller_id matches (Correct answer)
- Pinned query with the seller's product IDs
- Must clause on seller_id field
Correct answer: Script score query adding a fixed boost when seller_id matches
A script score query can add a conditional boost to documents where seller_id matches, elevating the seller's own products without hiding others.
Question 6: A company migrates a 500GB index to a new cluster with a different mapping. What is the safest approach to reindex with zero downtime?
- Use _reindex API with an alias swap after completion (Correct answer)
- Dump to JSON files and bulk import
- Use snapshot and restore, then update mapping
- Delete and recreate the index with new mapping
Correct answer: Use _reindex API with an alias swap after completion
Reindex API copies data to a new index with the correct mapping, and an alias swap atomically redirects traffic with no downtime.
Question 7: A data analytics team needs to run expensive aggregations on historical data without impacting live search performance. Which Elasticsearch feature is designed for this?
- Cross-cluster replication
- Rollup jobs
- Async search (Correct answer)
- Index lifecycle warm phase
Correct answer: Async search
Async search allows long-running aggregations to execute in the background and be retrieved later, preventing resource contention with live queries.
ElasticSearch Case Studies & Practical Application 3
A financial services firm ingests trade data and needs near-real-time aggregations with minimal indexing latency.
Which refresh strategy best meets this need?