--- title: "Elasticsearch: Full-Text Search Engine Fundamentals" description: "Test your knowledge on full-text search, document indexing, and log analysis using Elasticsearch and Kibana." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/quizzes/post/elasticsearch-search-engine-fundamentals-quiz --- # Elasticsearch: Full-Text Search Engine Fundamentals Welcome to the Elasticsearch Basics Quiz! Elasticsearch is the powerhouse behind modern log analysis and real-time search. Whether you are troubleshooting a production crash by digging through Filebeat logs or building a performance dashboard in Kibana, understanding the underlying index structure and Query DSL is a must-have skill for modern DevOps engineers. Let's see how much you know! ## Questions ### 1. What is the primary purpose of Elasticsearch? - To act as a primary relational storage for ACID transactions - Elasticsearch is document-oriented and optimized for search, not for traditional RDBMS transactions. - **To provide distributed search and near real-time analytics** ✅ - Correct! It is designed to handle large-scale search and analysis of structured or unstructured data. - To provide a low-latency content delivery network for media assets - Media delivery is handled by CDNs; Elasticsearch is an indexing and search engine. - To function as a centralized firewall and network traffic controller - Network control is handled by security appliances, though Elasticsearch can analyze the resulting logs. **Hint:** Think about speed and search. ### 2. In Elasticsearch, what is an "Index" equivalent to in a SQL database? - A Row - In the Elasticsearch model, an individual Document is the equivalent of a SQL Row. - **A Table** ✅ - Correct! An Index is a logical namespace that maps to one or more primary shards. - A Database - While an Index holds data, the Cluster itself is more comparable to a full database system. - A Column - A Field within a document is the equivalent of a SQL Column. **Hint:** A container for similar data. ### 3. What format does Elasticsearch use to store documents? - XML - While common in older systems, Elasticsearch standardized on JSON for document storage. - **JSON** ✅ - Correct! Documents are stored as JavaScript Object Notation (JSON) objects. - Protobuf - Protobuf is a binary format; Elasticsearch uses JSON for its external API and storage logic. - YAML - YAML is used for Elasticsearch configuration files, but not for the data documents themselves. **Hint:** Standard web object notation. ### 4. What is a "Shard" in Elasticsearch? - A specialized cache for frequently accessed search results - This describes the Request Cache or Node Query Cache, not a Shard. - **A horizontal partition of data that allows an index to scale** ✅ - Correct! Shards allow an index to be distributed across multiple nodes in a cluster. - A backup copy of the cluster state stored in a remote repository - This describes a Snapshot, while a Shard is a functional part of the live index. - A hardware-level optimization for SSD-based indexing performance - While shards benefit from SSDs, they are a logical software partitioning concept. **Hint:** Breaking an index into pieces. ### 5. What is the "Query DSL"? - A binary protocol for high-speed data ingestion - Data ingestion typically uses the REST API or specialized agents like Beats. - **A JSON-based language used to define searches and filters** ✅ - Correct! The Domain Specific Language allows users to build complex, nested search queries. - A SQL-to-REST translation layer for external database drivers - Elasticsearch has a SQL feature, but the Query DSL is its native JSON-based interface. - A schema definition tool for enforcing strict data types - Defining data types is the role of Mappings, not the Query DSL. **Hint:** Domain Specific Language. ### 6. Which HTTP method is used to retrieve a document by its ID? - POST - POST is generally used for creating new documents or executing complex searches. - **GET** ✅ - Correct! The GET method is used for direct retrieval of a specific document by its unique ID. - HEAD - HEAD checks for the existence of a document but does not return the document body. - PUT - PUT is used to index or update a document at a specific location, not primarily for retrieval. **Hint:** Standard REST method. ### 7. What is the role of "Kibana" in the ELK stack? - To act as a persistent queue for incoming log streams - Persistence and queuing are roles for tools like Kafka or Redis in larger pipelines. - **To provide a visual interface for data exploration and analysis** ✅ - Correct! Kibana is the visualization layer used to create dashboards and manage the cluster. - To parse and normalize raw text into structured JSON format - Parsing and normalization are handled by Logstash or Elasticsearch Ingest Pipelines. - To manage the distribution of shards across physical nodes - Shard management is handled internally by the Elasticsearch Master node. **Hint:** The window into the data. ### 8. What is a "Replica Shard"? - A temporary shard created during an index migration - Migrations may move shards, but replicas are a permanent part of high-availability design. - **A copy of a primary shard used for failover and read scaling** ✅ - Correct! Replicas provide redundancy and allow read queries to be distributed across more nodes. - A shard that stores only metadata about the cluster state - Metadata is stored in the cluster state; replica shards store the actual document data. - A read-only shard used for long-term archival of old data - Archival is handled via ILM and cold/frozen tiers, not specifically by "replica" status. **Hint:** A copy for safety. ### 9. Which port does Elasticsearch typically use for its REST API? - 9300 - Port 9300 is used for internal node-to-node communication (Transport layer). - **9200** ✅ - Correct! 9200 is the default port for HTTP traffic and REST API requests. - 5601 - Port 5601 is the default port for accessing the Kibana web interface. - 9100 - Port 9100 is often used by third-party tools like Prometheus Exporters or Elasticsearch Head. **Hint:** Between 9000 and 9500. ### 10. What is an "Inverted Index"? - A data structure that sorts documents by their creation date - Sorting by date is a separate indexing function; it does not describe the inverted index. - **A mapping of unique terms to the documents they appear in** ✅ - Correct! This allows for efficient full-text searches by looking up terms rather than scanning documents. - A backup index created in reverse order for disaster recovery - Disaster recovery relies on snapshots, not the internal structure of the index. - A method for compressing text fields to reduce disk usage - Compression is used within the index, but the "inverted" nature is about search logic. **Hint:** How Elasticsearch searches so fast. ### 11. Which Elasticsearch field type is used for "Full-Text Search"? - keyword - Keyword fields are used for exact matches and aggregations, not full-text search. - **text** ✅ - Correct! Text fields are passed through an analyzer to create an inverted index for searching. - binary - Binary fields store Base64 encoded data that is not searchable via full-text queries. - flattened - Flattened fields treat an entire JSON object as a single keyword field. **Hint:** Analyzed strings. ### 12. What is the purpose of "Mapping" in Elasticsearch? - To visualize geographical coordinates on a Kibana map - Visualizing coordinates uses the "Map" tool; "Mapping" is a schema definition. - **To define the schema and data types of document fields** ✅ - Correct! Mapping tells Elasticsearch how to treat fields, such as dates, numbers, or text. - To distribute documents across specific physical disk drives - Disk distribution is managed by the storage engine and shard allocation logic. - To track the relationships between different indexes - Elasticsearch is largely non-relational; mappings define internal document structure. **Hint:** Defining the schema. ### 13. What is a "Node" in an Elasticsearch cluster? - A specific JavaScript function within the Query DSL - Node.js is a runtime, but in Elasticsearch, a "Node" refers to a server instance. - **A single running instance of Elasticsearch in a cluster** ✅ - Correct! A cluster is composed of one or more nodes that share the data and workload. - An individual entry in an inverted index term list - Entries in the index are called terms or documents, not nodes. - A hardware load balancer that distributes API requests - Load balancers sit in front of the cluster; nodes are the participants within it. **Hint:** A single instance. ### 14. In Kibana, what is the "Discover" tab used for? - To browse the Kibana marketplace for new dashboard themes - Kibana does not have a marketplace for themes in the Discover tab. - **To interactively explore, filter, and view raw document data** ✅ - Correct! It allows users to search through logs and inspect individual document fields. - To perform automated security scans on the Elasticsearch cluster - Security scanning is a separate administrative function, not part of data discovery. - To detect and automatically fix broken index mappings - Mappings must be updated via the API; Discover is for viewing data only. **Hint:** Raw data exploration. ### 15. What does the "Match" query do in Elasticsearch? - Finds documents that have identical field values - Identical matching is typically performed using a "Term" query. - **Analyzes a search string and performs a full-text query** ✅ - Correct! It is the standard query for searching analyzed text fields like "title" or "body". - Identifies and merges duplicate documents in an index - Merging duplicates is a cleanup process, not a query function. - Compares two different indexes for structural differences - Structural comparison is an administrative task, not a search query. **Hint:** The standard search. ### 16. What is "Score" (_score) in search results? - The percentage of disk space occupied by the index - Disk space metrics are part of cluster health, not individual search results. - **A numeric value indicating document relevance to a query** ✅ - Correct! Elasticsearch uses BM25 or similar algorithms to rank how well a document matches. - The number of times a document has been viewed by users - Elasticsearch does not natively track "view counts" as part of the search score. - A performance metric showing the query execution time - Execution time is measured in milliseconds (took), not as a relevance score. **Hint:** Relevance calculation. ### 17. What is the purpose of an "Alias" in Elasticsearch? - To provide an encrypted nickname for sensitive API keys - API keys are managed through the security API, not index aliases. - **To provide a secondary name for one or more indexes** ✅ - Correct! Aliases allow you to switch indices without updating application code. - To compress the name of an index to save memory - Aliases are for logical grouping and flexibility, not for memory savings. - To create a hard link to a remote cluster index - Remote indexes are accessed via Cross-Cluster Search, not standard local aliases. **Hint:** A secondary name for an index. ### 18. What is "Logstash" used for? - To act as a high-speed load balancer for Kibana - Load balancing is handled by tools like Nginx or HAProxy. - **To ingest, transform, and ship data to Elasticsearch** ✅ - Correct! It is a server-side pipeline that can process logs from many sources. - To store long-term archival data in a compressed format - Elasticsearch stores the data; Logstash is only for the transit and transformation phase. - To provide a command-line interface for the REST API - The CLI interface is usually the Dev Tools in Kibana or "curl". **Hint:** The "L" in ELK. ### 19. What is an "Aggregations" query (aggs)? - A specialized query for retrieving large binary objects - Binary objects (blobs) are not the focus of the aggregations framework. - **A way to summarize and group data for analytics** ✅ - Correct! Aggregations allow you to calculate metrics like averages, sums, or histograms. - A method for merging multiple documents into a single entry - Merging data at index time is part of ingestion; aggregations only group results at query time. - A process for moving shards between different nodes - Shard movement is part of cluster rebalancing, not an aggregation query. **Hint:** Analytics and grouping. ### 20. What is a "Mapping Conflict"? - When two indices have the same name in different clusters - Indices must be unique within a cluster; this is not a mapping conflict. - **When a field is indexed with incompatible data types** ✅ - Correct! This occurs if one document has a field as a "string" and another has it as a "long". - When the master node fails to sync with data nodes - This describes a cluster synchronization or network issue, not a mapping conflict. - When two users attempt to update a document simultaneously - Simultaneous updates are handled via Optimistic Concurrency Control (versions). **Hint:** Type mismatch. ### 21. Which tool focuses on lightweight data shipping in the Elastic Stack? - Logstash Data-Pump - Logstash is a heavyweight Java-based process, not a lightweight shipper. - **Beats (Filebeat, Metricbeat)** ✅ - Correct! Beats are lightweight shippers written in Go that send data to Logstash or Elasticsearch. - Kibana Lens - Kibana Lens is a visualization tool, not a data shipper. - Elastic Search-Agent - While an Elastic Agent exists, "Beats" is the standard term for lightweight shippers. **Hint:** Small, purpose-built agents. ### 22. What is the "Bulk API"? - An API for retrieving documents in large batches - Retrieving large batches is usually handled by the Scroll or Search After APIs. - **An API for performing many index/delete operations at once** ✅ - Correct! It reduces network overhead by grouping multiple actions into a single request. - A management tool for upgrading the cluster version - Upgrading is handled via node restarts or the ECE/ECK orchestrators. - A specialized query for searching through encrypted data - Bulk API is about operational efficiency, not data security or encryption. **Hint:** High-speed ingestion. ### 23. What does "Near Real-Time" (NRT) mean in Elasticsearch? - Data is searchable exactly 1 hour after indexing - Search latency is typically measured in seconds, not hours. - **There is a slight delay before indexed data is searchable** ✅ - Correct! By default, it takes about 1 second for a document to be searchable after indexing. - Data is written to memory but only searchable after a restart - Restarts are not required for searchability; the "refresh" operation handles this. - Queries only return results that were indexed yesterday - Elasticsearch returns the most recently refreshed data, not just old data. **Hint:** Indexing latency. ### 24. What is the purpose of the "Term" query? - To find documents containing a specific analyzed sentence - Searching analyzed sentences is the role of the "Match" query. - **To find documents that contain an exact, unanalyzed value** ✅ - Correct! It is used for structured data like product IDs, tags, or status codes. - To calculate the frequency of words across an entire index - Word frequency analysis is performed using aggregations or the Term Vectors API. - To define the expiration time of a specific document - Document expiration was historically handled by "_ttl" but is now managed via ILM. **Hint:** Exact matching. ### 25. What is "Lucene"? - A visualization plugin for displaying network graphs - Visualization is handled by Kibana; Lucene is a search library. - **The search library that Elasticsearch is built upon** ✅ - Correct! Lucene is a high-performance Java library used for indexing and search. - A cloud-based orchestration tool for Elastic clusters - Cloud orchestration is handled by Elastic Cloud or Kubernetes (ECK). - A specialized data type for storing 3D model geometry - Lucene is a general-purpose search library, not a 3D data type. **Hint:** The engine under the hood. ### 26. In Kibana, what is an "Index Pattern"? - A graphical template for designing index mappings - Mappings are technical definitions; index patterns are for Kibana data selection. - **A setting that tells Kibana which indices to visualize** ✅ - Correct! It uses wildcards (like logs-*) to group related indices for analysis. - A mathematical formula used for relevance scoring - Scoring is handled by Elasticsearch (BM25), not by Kibana index patterns. - A security rule that restricts access to specific documents - Security is handled via Roles and Document Level Security (DLS). **Hint:** How Kibana knows where to look. ### 27. What is "Split Brain" in a cluster? - A performance optimization that splits queries across CPUs - This is parallel processing; split brain is a failure state. - **A state where two nodes both believe they are the Master** ✅ - Correct! It occurs when nodes lose communication and can lead to data corruption. - A backup strategy where data is mirrored to a separate cluster - This is called Cross-Cluster Replication (CCR). - An indexing method that separates text and numeric data - Data separation is handled by the index mapping, not by a "split brain" state. **Hint:** A failure in consensus. ### 28. What is "Canvas" in Kibana? - A low-level API for drawing custom charts in JavaScript - Kibana uses Canvas for infographics, but it is a higher-level tool than a raw JS API. - **A data-driven presentation tool for infographic dashboards** ✅ - Correct! It allows for highly customized, live-updating visual displays of data. - A background service that cleans up deleted shards - Shard cleanup is an internal Elasticsearch task, not a Kibana tool. - A sandbox environment for testing new index mappings - Testing is usually done in the Dev Tools Console or a separate test index. **Hint:** Advanced presentation. ### 29. Which command shows the health of an Elasticsearch cluster? - GET /_cluster/stats - This returns detailed statistics about the cluster, but not the simple health status. - **GET /_cluster/health** ✅ - Correct! It returns the Green, Yellow, or Red status of the cluster. - GET /_node/status - This is not a valid endpoint for overall cluster health. - GET /_system/health - This is not a standard Elasticsearch API endpoint. **Hint:** API for health. ### 30. What is "Index Lifecycle Management" (ILM)? - A security protocol for rotating database passwords - Password rotation is part of general security, not index lifecycle management. - **A way to automate the movement and deletion of indices** ✅ - Correct! It manages indices through Hot, Warm, Cold, and Delete phases. - A tool for recovering deleted documents from the trash bin - Deleted documents in Elasticsearch cannot be recovered from a trash bin. - A method for calculating the uptime of a cluster node - Uptime is a monitoring metric, not a lifecycle management policy. **Hint:** Automating index aging.