ElasticSearch Trivia 5 — Questions and Answers
Question 1: What Elasticsearch component processes and transforms data before it is indexed, using a series of processors?
- Logstash filter
- Ingest Pipeline (Correct answer)
- Transform API
- Watcher
Correct answer: Ingest Pipeline
Ingest Pipelines are node-level processing chains that apply processors (e.g., grok, date, rename) to documents before they are indexed.
Question 2: Which Elasticsearch query type finds documents where a field's value falls within a specified range?
- Term query
- Match query
- Range query (Correct answer)
- Fuzzy query
Correct answer: Range query
The range query matches documents with field values between specified upper and lower bounds, supporting dates, numbers, and strings.
Question 3: What is a 'data stream' in Elasticsearch primarily designed for?
- Real-time streaming analytics with Kafka
- Time-series data that is append-only (Correct answer)
- Distributing data across clusters
- Managing cross-cluster replication
Correct answer: Time-series data that is append-only
Data streams are designed to handle time-series data (like logs and metrics) by managing a series of backing indices automatically.
Question 4: What does the 'dynamic mapping' feature do in Elasticsearch when a new field is encountered?
- Rejects the document
- Automatically detects and maps the field type (Correct answer)
- Stores the field as a keyword only
- Requires manual schema update
Correct answer: Automatically detects and maps the field type
Dynamic mapping allows Elasticsearch to automatically detect field types (string, number, date, etc.) and add them to the index mapping.
Question 5: Which Elasticsearch feature sends alerts based on query results or metric thresholds?
- Kibana Lens
- Watcher (Alerting) (Correct answer)
- Machine Learning Jobs
- APM
Correct answer: Watcher (Alerting)
Watcher (now part of Kibana Alerting) monitors data using scheduled queries and triggers actions like emails or webhooks when conditions are met.
Question 6: What is 'fielddata' in Elasticsearch and why is it disabled by default for text fields?
- An in-memory cache that enables sorting/aggregations on analyzed text, disabled due to high heap usage (Correct answer)
- A disk-based field index, disabled for speed
- A field compression format, disabled for compatibility
- A cross-cluster field sync, disabled for security
Correct answer: An in-memory cache that enables sorting/aggregations on analyzed text, disabled due to high heap usage
Fielddata loads text field data into JVM heap memory for aggregations/sorting, but is disabled by default because it can cause OutOfMemory errors.
Question 7: In which year was the first public release of Elasticsearch?
- 2008
- 2010 (Correct answer)
- 2012
- 2014
Correct answer: 2010
Elasticsearch version 0.4 was publicly released in February 2010 by Shay Banon.
ElasticSearch Trivia 5
What Elasticsearch component processes and transforms data before it is indexed, using a series of processors?