ElasticSearch Quality Control & Assurance 5 — Questions and Answers
Question 1: How does the `_source` field configuration affect data quality and storage in Elasticsearch?
- Disabling _source reduces heap usage but prevents document updates and reindexing (Correct answer)
- Disabling _source improves search relevance scoring
- Enabling _source compresses all stored fields automatically
- Disabling _source forces Elasticsearch to use doc values for all queries
Correct answer: Disabling _source reduces heap usage but prevents document updates and reindexing
Disabling `_source` saves disk space but prevents `_update`, `update_by_query`, and reindex operations, which require the original document to be available.
Question 2: What is the role of the `_doc_count` field when performing quality checks on aggregation results from a rollup or summary index?
- It stores the original document's word count
- It tells Elasticsearch how many source documents a pre-aggregated bucket represents for accurate metric calculations (Correct answer)
- It tracks the number of failed indexing attempts
- It counts the number of nested objects in a document
Correct answer: It tells Elasticsearch how many source documents a pre-aggregated bucket represents for accurate metric calculations
`_doc_count` allows a pre-summarized document to represent multiple source documents in aggregations, ensuring metrics like averages are computed correctly across rolled-up data.
Question 3: During a QA review of Elasticsearch mapping, you find `"index": false` on a field. What does this mean?
- The field is excluded from _source
- The field is stored but cannot be used in queries or filters (Correct answer)
- The field uses keyword tokenization only
- The field is replicated to all nodes immediately
Correct answer: The field is stored but cannot be used in queries or filters
Setting `"index": false` means the field's values are stored in `_source` but not added to the inverted index, so it cannot be searched, filtered, or aggregated.
Question 4: Which Elasticsearch feature provides automatic quality enforcement by rejecting documents that would cause a shard's disk usage to exceed a configured limit?
- ILM delete phase
- Disk-based shard allocation with flood-stage watermark (Correct answer)
- Index block `write` set via template
- Circuit breaker for in-flight requests
Correct answer: Disk-based shard allocation with flood-stage watermark
The flood-stage watermark (default 95%) causes Elasticsearch to block writes to all indices on a node when disk usage is critically high, protecting node stability.
Question 5: What technique ensures that an Elasticsearch alias always points to the most current index while keeping historical data queryable?
- Use `is_write_index: true` on one index in a multi-index alias (Correct answer)
- Create a separate alias per index version
- Set `index.hidden: true` on old indices
- Use a wildcard pattern in the alias filter
Correct answer: Use `is_write_index: true` on one index in a multi-index alias
Marking one index as `is_write_index: true` in an alias directs all writes to that index while the alias can still span multiple indices for reads, supporting zero-downtime rollover.
Question 6: You want to verify that a multi-field mapping (e.g., `title` with a `keyword` sub-field) is being used correctly in aggregations. What QA step confirms this?
- Run `_analyze` on the title field
- Run a terms aggregation on `title.keyword` and verify bucketed results contain exact values (Correct answer)
- Check `_cat/fielddata` for the title field
- Inspect `_segments` for the title field's codec
Correct answer: Run a terms aggregation on `title.keyword` and verify bucketed results contain exact values
Running a terms aggregation on `title.keyword` and verifying that buckets contain exact, un-analyzed strings confirms the keyword sub-field is indexed and used correctly.
Question 7: Which Elasticsearch configuration helps QA teams ensure that no single bulk request can consume excessive heap and destabilize the cluster?
- index.refresh_interval
- http.max_content_length (Correct answer)
- indices.breaker.request.limit
- cluster.max_shards_per_node
Correct answer: http.max_content_length
`http.max_content_length` (default 100MB) limits the size of any single HTTP request body, preventing oversized bulk requests from saturating network buffers and heap.
ElasticSearch Quality Control & Assurance 5
How does the `_source` field configuration affect data quality and storage in Elasticsearch?