ElasticSearch Case Studies & Practical Application 5 — Questions and Answers
Question 1: A gaming platform indexes player activity and needs leaderboard queries to return the top 100 players globally with sub-100ms latency. What optimization is most impactful?
- Increase max_result_window to 10000
- Pre-compute rankings using a Transform and store results in a separate index (Correct answer)
- Use a terms aggregation with size=100
- Add more replica shards to handle concurrent queries
Correct answer: Pre-compute rankings using a Transform and store results in a separate index
Transforms pre-aggregate leaderboard data into a summary index, enabling sub-millisecond reads instead of expensive real-time aggregations.
Question 2: A company uses cross-cluster replication (CCR) to maintain a disaster recovery cluster. After a failover, users report search results are 30 seconds stale. What explains this?
- CCR replicates asynchronously, introducing replication lag (Correct answer)
- The follower index has a higher refresh interval
- Replicas are not promoted to primaries automatically
- The CCR soft deletes retention period is too short
Correct answer: CCR replicates asynchronously, introducing replication lag
CCR replicates operations asynchronously from the leader, so follower indices may lag behind the leader by seconds to minutes depending on network and load.
Question 3: An enterprise ingests employee directories and needs to search by partial phone number. The phone field stores values like '+1-800-555-1234'. Which analyzer approach is correct?
- Map phone as keyword and use a wildcard query
- Apply a custom analyzer with n-gram tokenizer on the phone field (Correct answer)
- Use a regexp query on a text field
- Store phone as integer type
Correct answer: Apply a custom analyzer with n-gram tokenizer on the phone field
An n-gram analyzer tokenizes the phone number into all substrings, enabling efficient partial matches without expensive wildcard or regexp queries.
Question 4: A security operations center uses Elasticsearch SIEM. Analysts need to correlate events from multiple log sources using a shared transaction ID. Which ingest technique links these events?
- Using a join field type between indices
- Using an ingest pipeline with an enrich processor to look up transaction metadata (Correct answer)
- Using parent-child relationships with has_child queries
- Using a collapse parameter on the transaction_id field
Correct answer: Using an ingest pipeline with an enrich processor to look up transaction metadata
An enrich processor in an ingest pipeline looks up data from an enrich policy and appends correlated metadata to incoming documents at index time.
Question 5: A content platform needs to prevent adult content from appearing in searches for users who have safe-search enabled. What is the cleanest implementation?
- Maintain two separate indices for safe and adult content
- Apply a post-filter on every query checking the adult_content flag
- Use document-level security with a role that filters adult_content=true documents
- Use index aliases with a filter on adult_content=false for safe-search users (Correct answer)
Correct answer: Use index aliases with a filter on adult_content=false for safe-search users
A filtered alias transparently applies a query filter to all searches through that alias, cleanly enforcing safe-search without modifying application queries.
Question 6: A software company indexes code repositories and needs to support searches like 'find files with function named getUserById'. Which analyzer handles code-specific tokenization best?
- Standard analyzer
- Whitespace analyzer with a lowercase filter
- Pattern analyzer splitting on camelCase and underscores (Correct answer)
- Fingerprint analyzer
Correct answer: Pattern analyzer splitting on camelCase and underscores
A pattern analyzer with a regex that splits on camelCase boundaries and underscores correctly tokenizes code identifiers like getUserById into 'get', 'user', 'by', 'id'.
Question 7: An online auction site needs to display faceted counts (e.g., 'Electronics: 342, Clothing: 218') even when a user has already filtered by a category. Which aggregation technique achieves this?
- Using a global aggregation with a nested terms aggregation
- Using post_filter combined with aggregations outside the filter (Correct answer)
- Using a filtered aggregation per category
- Using a significant terms aggregation
Correct answer: Using post_filter combined with aggregations outside the filter
Post_filter applies to returned hits only while aggregations run on the full result set, allowing facet counts to reflect the unfiltered universe.
ElasticSearch Case Studies & Practical Application 5
A gaming platform indexes player activity and needs leaderboard queries to return the top 100 players globally with sub-100ms latency.
What optimization is most impactful?