ElasticSearch Quality Control & Assurance 3 — Questions and Answers
Question 1: Which Elasticsearch component should you test to verify that log enrichment (e.g., adding geoip fields) is working correctly before data reaches an index?
- Index template
- Ingest pipeline using the Simulate API (Correct answer)
- Alias filter
- ILM policy
Correct answer: Ingest pipeline using the Simulate API
The `POST /_ingest/pipeline/<id>/_simulate` API lets you test an ingest pipeline against sample documents without indexing them, verifying processors like geoip or set.
Question 2: What does a `yellow` cluster health status indicate that you must investigate for production quality assurance?
- All shards are assigned but indexing is paused
- Primary shards are all assigned but one or more replica shards are unassigned (Correct answer)
- At least one primary shard is unassigned, causing data loss risk
- The cluster is in read-only mode
Correct answer: Primary shards are all assigned but one or more replica shards are unassigned
Yellow status means all primaries are active but some replicas are unassigned, so the cluster is functional but lacks full redundancy.
Question 3: When auditing Elasticsearch security, which setting enables field-level security to restrict which document fields a role can read?
- xpack.security.transport.ssl.enabled
- field_security in the role definition (Correct answer)
- indices.query.bool.max_clause_count
- index.mapping.total_fields.limit
Correct answer: field_security in the role definition
Field-level security is configured via `field_security` (with `grant` or `except` lists) in an Elasticsearch role definition under the `indices` section.
Question 4: Which Elasticsearch API helps quality teams verify that a search query uses the expected index and shard routing?
- GET /_search_shards (Correct answer)
- GET /_cat/shards
- POST /_reindex
- GET /_cluster/reroute
Correct answer: GET /_search_shards
`GET /_search_shards` returns the indices and shards a search request would be executed against, useful for verifying routing and alias resolution.
Question 5: How can you detect that an Elasticsearch index has too many fields, which may degrade performance and stability?
- Check `_cat/indices` for a high doc count
- Check `_mapping` and compare total field count against `index.mapping.total_fields.limit` (Correct answer)
- Monitor `jvm.gc.collectors.young.collection_count`
- Review `_cat/segments` for large segment sizes
Correct answer: Check `_mapping` and compare total field count against `index.mapping.total_fields.limit`
Fetching the index mapping and counting fields against the `index.mapping.total_fields.limit` (default 1000) identifies mapping explosion, which strains heap and coordination.
Question 6: What Elasticsearch mechanism ensures that data written to the transaction log is durably persisted to disk?
- Segment merging
- Translog fsync (index.translog.durability) (Correct answer)
- Fielddata circuit breaker
- Refresh interval
Correct answer: Translog fsync (index.translog.durability)
`index.translog.durability` set to `request` ensures the translog is fsynced after every index or delete operation, guaranteeing durability at the cost of some write throughput.
Question 7: Which approach is best for load testing an Elasticsearch cluster's indexing quality under realistic conditions?
- Run _reindex from a small test index
- Use Rally (esrally) with a representative workload track (Correct answer)
- Trigger manual segment merges and observe latency
- Query _cat/thread_pool for rejected counts
Correct answer: Use Rally (esrally) with a representative workload track
Rally is Elasticsearch's official benchmarking tool that replays realistic indexing and search workloads, measuring throughput, latency, and error rates.
ElasticSearch Quality Control & Assurance 3
Which Elasticsearch component should you test to verify that log enrichment (e.g., adding geoip fields) is working correctly before data reaches an index?