ElasticSearch Quality Control & Assurance 3

Question 1

Which Elasticsearch component should you test to verify that log enrichment (e.g., adding geoip fields) is working correctly before data reaches an index?

Accepted Answer

Ingest pipeline using the Simulate API

Answer

The `POST /_ingest/pipeline/<id>/_simulate` API lets you test an ingest pipeline against sample documents without indexing them, verifying processors like geoip or set.

Question 2

What does a `yellow` cluster health status indicate that you must investigate for production quality assurance?

Accepted Answer

Primary shards are all assigned but one or more replica shards are unassigned

Answer

Yellow status means all primaries are active but some replicas are unassigned, so the cluster is functional but lacks full redundancy.

Question 3

When auditing Elasticsearch security, which setting enables field-level security to restrict which document fields a role can read?

Accepted Answer

field_security in the role definition

Answer

Field-level security is configured via `field_security` (with `grant` or `except` lists) in an Elasticsearch role definition under the `indices` section.

Question 4

Which Elasticsearch API helps quality teams verify that a search query uses the expected index and shard routing?

Accepted Answer

GET /_search_shards

Answer

`GET /_search_shards` returns the indices and shards a search request would be executed against, useful for verifying routing and alias resolution.

Question 5

How can you detect that an Elasticsearch index has too many fields, which may degrade performance and stability?

Accepted Answer

Check `_mapping` and compare total field count against `index.mapping.total_fields.limit`

Answer

Fetching the index mapping and counting fields against the `index.mapping.total_fields.limit` (default 1000) identifies mapping explosion, which strains heap and coordination.

ElasticSearch Practice Test

ElasticSearch Practice Test

ElasticSearch Quality Control & Assurance 3