ElasticSearch Technology & Digital Applications 2 — Questions and Answers
Question 1: Which Elasticsearch feature allows you to search across multiple indices using a single query?
- Cross-cluster replication
- Multi-index search with wildcards (Correct answer)
- Index aliases
- Data streams
Correct answer: Multi-index search with wildcards
Elasticsearch supports multi-index search by specifying multiple index names or wildcard patterns (e.g., logs-*) in a single query.
Question 2: What does the 'refresh_interval' setting control in an Elasticsearch index?
- How often snapshots are taken
- How frequently shards are reallocated
- How often new documents become searchable (Correct answer)
- How often mappings are updated
Correct answer: How often new documents become searchable
The refresh_interval determines how often Elasticsearch refreshes the index, making newly indexed documents visible to searches.
Question 3: In Elasticsearch, what is the purpose of the '_source' field?
- It stores the document routing key
- It contains the original JSON document as indexed (Correct answer)
- It holds the shard allocation metadata
- It tracks document version history
Correct answer: It contains the original JSON document as indexed
The _source field stores the original JSON body of a document, allowing retrieval of the full original document.
Question 4: Which Elasticsearch query type is best for full-text search on analyzed fields?
- term query
- match query (Correct answer)
- range query
- exists query
Correct answer: match query
The match query is the standard query for full-text search, applying the same analyzer used at index time to the search terms.
Question 5: What happens to a document when you update it in Elasticsearch?
- The existing document is modified in-place
- A new version is created and the old one is marked for deletion (Correct answer)
- The document is moved to a new shard
- The update is queued until the next merge
Correct answer: A new version is created and the old one is marked for deletion
Elasticsearch documents are immutable; an update creates a new version of the document and marks the old version for deletion during segment merging.
Question 6: What is an Elasticsearch data stream primarily designed for?
- Real-time streaming analytics with Kafka
- Time-series data like logs and metrics (Correct answer)
- Synchronizing data between clusters
- Managing large binary file storage
Correct answer: Time-series data like logs and metrics
Data streams are designed for append-only, time-series use cases like logs and metrics, automatically managing the underlying backing indices.
Question 7: In Elasticsearch, what does the 'from' and 'size' parameter combination control?
- The shard count and replica count
- Pagination of search results (Correct answer)
- The index refresh frequency and batch size
- The maximum field count per document
Correct answer: Pagination of search results
The 'from' parameter sets the starting offset and 'size' sets the number of results to return, together implementing search result pagination.
ElasticSearch Technology & Digital Applications 2
Which Elasticsearch feature allows you to search across multiple indices using a single query?