ElasticSearch ElasticSearch 5 — Questions and Answers
Question 1: What is the purpose of the `fielddata` setting for text fields in Elasticsearch?
- Enables the field to be used in full-text search queries
- Allows text fields to be used in sorting and aggregations by loading data into heap memory (Correct answer)
- Stores raw field values on disk for source retrieval
- Enables the field to participate in cross-cluster search
Correct answer: Allows text fields to be used in sorting and aggregations by loading data into heap memory
fielddata loads analyzed text field values into the JVM heap to enable sorting and aggregations on text fields, but it is memory-intensive and disabled by default.
Question 2: Which Elasticsearch API allows you to execute multiple search requests in a single HTTP request?
- Bulk API
- Multi Search (msearch) API (Correct answer)
- Scroll API
- Search Template API
Correct answer: Multi Search (msearch) API
The Multi Search API (msearch) allows you to bundle multiple search requests in a single HTTP call, reducing round-trip overhead.
Question 3: What does a 'split brain' problem mean in the context of an Elasticsearch cluster?
- A shard being split across two nodes due to storage limits
- Two or more master nodes simultaneously believing they are the active master (Correct answer)
- A replica shard containing different data than its primary
- An index mapping having conflicting field type definitions
Correct answer: Two or more master nodes simultaneously believing they are the active master
Split brain occurs when a network partition causes nodes to elect multiple masters, leading to inconsistent cluster states that can corrupt data.
Question 4: What is the `_bulk` API in Elasticsearch primarily used for?
- Running large aggregations across many shards simultaneously
- Performing multiple index, delete, or update operations in a single request (Correct answer)
- Transferring data between remote clusters in bulk
- Snapshotting multiple indices at the same time
Correct answer: Performing multiple index, delete, or update operations in a single request
The Bulk API allows batching multiple index, create, update, and delete operations into a single API call to reduce network overhead.
Question 5: Which query in Elasticsearch is best suited for searching documents based on an exact keyword value without analysis?
- match query
- term query (Correct answer)
- query_string query
- fuzzy query
Correct answer: term query
The term query finds documents that contain an exact, unanalyzed value in a field, making it ideal for keyword, numeric, and date fields.
Question 6: What is Index Lifecycle Management (ILM) in Elasticsearch primarily designed to do?
- Automatically generate index mappings based on ingested data patterns
- Automate index management tasks like rollover, shrink, delete based on defined policies (Correct answer)
- Monitor index health and alert on anomalies
- Replicate indices across geographically distributed clusters
Correct answer: Automate index management tasks like rollover, shrink, delete based on defined policies
ILM automates the management of indices through configurable lifecycle phases (hot, warm, cold, delete), reducing operational burden for time-series data.
Question 7: What does the `scroll` API in Elasticsearch enable?
- Paginating deeply through large result sets by maintaining a search context (Correct answer)
- Streaming real-time document changes to external consumers
- Scrolling through aggregation buckets beyond the default shard_size limit
- Fetching documents in random order for sampling purposes
Correct answer: Paginating deeply through large result sets by maintaining a search context
The Scroll API allows retrieving large numbers of results (or all results) from a query by maintaining a consistent search context across multiple requests.
ElasticSearch ElasticSearch 5
What is the purpose of the `fielddata` setting for text fields in Elasticsearch?