ElasticSearch Communication & Stakeholder Relations 3 — Questions and Answers
Question 1: An executive asks why the engineering team wants to increase the number of shards before a major data ingestion event. What is the clearest business justification?
- More shards reduce licensing costs
- More shards allow Elasticsearch to distribute indexing and search workload across more nodes in parallel, improving throughput and reducing per-node load (Correct answer)
- More shards automatically increase disk space on each node
- Shard count determines how many users can log in concurrently
Correct answer: More shards allow Elasticsearch to distribute indexing and search workload across more nodes in parallel, improving throughput and reducing per-node load
Shards are the unit of parallelism in Elasticsearch; increasing shard count before a data surge distributes the load across the cluster.
Question 2: A project manager asks what a 'yellow' cluster health status means and whether they should be alarmed. What is the correct explanation?
- Yellow means the cluster is offline and all writes are rejected
- Yellow means all primary shards are active but at least one replica shard is unassigned, so data is available but redundancy is reduced (Correct answer)
- Yellow means query performance has degraded below acceptable thresholds
- Yellow means the master node has elected a new leader
Correct answer: Yellow means all primary shards are active but at least one replica shard is unassigned, so data is available but redundancy is reduced
Yellow status indicates primaries are healthy and data is accessible, but missing replicas mean reduced fault tolerance until reassignment completes.
Question 3: During a post-incident review, a stakeholder asks why a mapping explosion caused cluster instability. How do you explain it?
- A mapping explosion occurs when too many nodes join the cluster simultaneously
- Dynamic field mapping allowed unbounded new fields to be created, exhausting JVM heap memory used to hold mapping metadata (Correct answer)
- Mapping explosions happen when queries exceed the maximum clause limit
- A mapping explosion is caused by a corrupt snapshot restore
Correct answer: Dynamic field mapping allowed unbounded new fields to be created, exhausting JVM heap memory used to hold mapping metadata
Unbounded dynamic mapping creates thousands of fields in the cluster state, consuming heap memory on all nodes and causing instability.
Question 4: A non-technical stakeholder wants to understand what 'relevance scoring' means in Elasticsearch. Which explanation is most accurate?
- Relevance scoring ranks documents by their file size, with larger documents ranked higher
- Elasticsearch assigns each matching document a numeric score based on how well it matches the query terms, using factors like term frequency and field length (Correct answer)
- Relevance scoring filters out documents that do not exactly match all query terms
- Relevance scoring is applied only when sorting by a date field
Correct answer: Elasticsearch assigns each matching document a numeric score based on how well it matches the query terms, using factors like term frequency and field length
Elasticsearch uses TF/IDF or BM25 algorithms to compute a _score that reflects how closely a document matches the query, used to rank results.
Question 5: A stakeholder asks why the team is recommending Elasticsearch over a relational database for a log analytics use case. What is the strongest argument?
- Elasticsearch enforces strict schema and foreign key constraints better than SQL databases
- Elasticsearch is optimized for full-text search and aggregations over large volumes of semi-structured log data, with horizontal scalability that relational databases do not provide natively (Correct answer)
- Elasticsearch supports stored procedures and complex transactions that SQL cannot
- Elasticsearch is cheaper than all relational database options
Correct answer: Elasticsearch is optimized for full-text search and aggregations over large volumes of semi-structured log data, with horizontal scalability that relational databases do not provide natively
Elasticsearch's inverted index, distributed architecture, and aggregation framework make it purpose-built for log search and analytics at scale.
Question 6: A QA engineer reports that a search returns no results for a term that clearly exists in the index. You suspect an analyzer mismatch. How do you communicate the root cause to a non-technical stakeholder?
- The index is corrupted and needs to be rebuilt from scratch
- The text was transformed at index time (e.g., lowercased or stemmed) but the query used a different analysis pipeline, so the terms did not match (Correct answer)
- Elasticsearch blocked the query because it contained a reserved keyword
- The document was indexed on a replica shard that is currently unavailable
Correct answer: The text was transformed at index time (e.g., lowercased or stemmed) but the query used a different analysis pipeline, so the terms did not match
Analyzer mismatches between index time and query time cause tokens to differ, resulting in no matches even when the text appears to be present.
Question 7: A stakeholder asks what the Elasticsearch Kibana dashboard adds beyond what raw API responses provide. What is the best answer?
- Kibana is required for Elasticsearch to function; without it, queries cannot run
- Kibana provides visual dashboards, charts, and alerting on top of Elasticsearch data, making it accessible to non-engineers without writing JSON queries (Correct answer)
- Kibana stores a separate copy of all indexed data for faster dashboard rendering
- Kibana replaces the need for index templates and mappings
Correct answer: Kibana provides visual dashboards, charts, and alerting on top of Elasticsearch data, making it accessible to non-engineers without writing JSON queries
Kibana is a visualization layer that lets business users explore Elasticsearch data through UI-driven dashboards without needing to write DSL queries.
ElasticSearch Communication & Stakeholder Relations 3
An executive asks why the engineering team wants to increase the number of shards before a major data ingestion event.
What is the clearest business justification?