All 36 Elasticsearch quiz questions below come with a short explanation, visible right on the page — no sign-in needed. They're grouped by beginner and intermediate levels and 36 subtopics, so you can revise one part at a time. Choose Try Elasticsearch quiz above to take a scored run and review the questions you got wrong.
A.Fields stored in separate columns for computation
B.Documents compressed and stored in chronological order
C.Terms mapped to the list of documents containing them
D.Documents mapped to the list of terms inside them
Answer: C
An inverted index maps keywords to the list of documents containing them. Finding a word just requires looking up one key and taking the list, instead of scanning all documents like string matching in a relational database.
What are the different roles of shards and replicas in Elasticsearch?
A.A shard sits on one machine and its replica on the same one
B.Shards divide the data while replicas are copies of a shard
C.Shards serve writes while replicas serve only aggregations
D.Shards are the copies while replicas hold the original data
Answer: B
Shard splits an index's data to distribute across many machines; replica is a copy of a shard, placed on another machine for fault tolerance and higher read throughput. The number of primary shards is fixed at index creation, while the number of replicas can change.
A.text is analysed into terms while keyword is not
B.text cannot be searched and is only for display
C.keyword supports Vietnamese while text does not
D.text can store far longer strings than keyword
Answer: A
text is analyzed into tokens, so it suits full-text search; keywordkeeps the string intact, so it suits exact filtering, sorting, and aggregation. This is the most important distinction when designing a mapping.
What are the components of an analyzer in Elasticsearch?
A.A data compressor and a character encoder
B.A spell checker and a language translator
C.A sorter and a relevance scorer
D.Character filters, a tokenizer and token filters
Answer: D
Three layers run in sequence: character filters process the raw string, a tokenizer splits it into tokens, then token filters normalize them, such as lowercasing, removing diacritics, and dropping stop words. When indexing a document, the output terms go into the inverted index; when searching, the output terms are only used to build the query.
A.match is only for numbers while term is only for strings
B.match can only find one word while term finds several
C.term is faster because it skips the relevance scoring
D.match analyses the search string while term does not
Answer: D
matchanalyzes the search string with the field's analyzer before matching, while term matches exactly against what is in the index. Using term on a text field usually returns no results.
A document is indexed but not found immediately. Why?
A.The replica has not synchronized so the query does not see it
B.The document becomes findable after the next refresh
C.The index must be optimized before it can be found
D.The document has not been written to disk successfully
Answer: B
Elasticsearch is near real-time: a document only becomes findable after the next refresh, about one second by default. The data is durable as soon as the write completes; it just hasn't appeared in search results yet.
Why is Elasticsearch usually not used as the primary datastore?
A.It cannot look documents up by their identifier
B.It has no transactions and no integrity constraints
C.It cannot persist data durably to disk
D.It cannot scale as the data grows
Answer: B
It has no multi-document transactions, no foreign keys, and no integrity constraints. The common pattern is to keep the source of truth in a transactional database and sync to Elasticsearch to serve search.
C.A new field's type is guessed the first time it is seen
D.A new field is ignored until it is declared explicitly
Answer: C
A new field gets its type guessed when the first document containing it arrives. Convenient for experimentation but dangerous in production: if the type is guessed wrong, you must create a new index and reindex all the data to fix it.
How should a million records be loaded into Elasticsearch?
A.Create a separate index for every thousand records
B.Send one document at a time so errors are easy to catch
C.Write the data files straight into the index's directory
D.Use the bulk indexing API in batches
Answer: D
Use the bulk API in batches of a few megabytes each. Combining many documents into one request sharply reduces network and processing overhead, and this is a tens-of-times difference in indexing speed.
An alias is a fixed name pointing to the real index. The application always calls through the alias, so when the mapping needs to change you create a new index, reindex the data, then switch the alias over, with no downtime.
What does putting a condition in filter rather than must gain?
A.The condition also applies to the other indices
B.No relevance scoring, and the result is cached
C.The results come back sorted by time
D.The condition is applied before the search begins
Answer: B
Conditions in filterdo not contribute to scoring and are cached at the filter layer. For frequently repeated conditions such as active status or time ranges, the performance difference is very clear.
What does the default relevance score in Elasticsearch depend on?
A.The order in which the documents were added to the index
B.How many users clicked on that document
C.Term frequency, the term's rarity and the field's length
D.When the document was written into the index
Answer: C
Three main factors: term frequency in the document, term rarity across the whole index, and field length. A rare term carries more information, and with the same number of occurrences a shorter field is considered more relevant.
Why does from and size pagination fail for deep pages?
A.Each shard must return results up to that position
B.The filter cache does not work on deep pages
C.Elasticsearch does not support jumping to an arbitrary page
D.Results repeat when new documents are written
Answer: A
Because each shard must return all results up to that position for the coordinating node to re-sort. Cost grows with page depth, so there is a default limit of about ten thousand results to protect the cluster.
What characterises a distinct count aggregation result?
A.It only counts the documents on the current result page
B.It is approximate, with an error at large cardinalities
C.It only counts on numeric fields
D.It is always exact at any data size
Answer: B
It is an approximate count: the estimation algorithm trades accuracy for fixed memory. With a small number of values the result is usually correct, while with a large number of values there is an error of a few percent.
What problem arises when an array of objects is stored as the default object type?
A.The array is converted to a string when stored
B.The inner fields cannot be aggregated
C.The relationship between fields within one element is lost
D.Only the array's first element is indexed
Answer: C
Fields are flattened into separate lists, so the relationship within the same element is lost. Searching for products that are red and large will also match a product with a small red variant and a large green variant.
D.Download the whole list to the client and filter locally
Answer: C
Use an edge n-gram filter at index time: each word is pre-split into prefixes. The query while typing is just an ordinary term match so it is very fast, at the cost of a larger index and needing to reindex when the configuration changes.
What extra handling does Vietnamese search need compared with English?
A.Nothing extra is needed since the standard analyzer suffices
B.A separate analyzer is needed for each region
C.Normalize the diacritics and let unaccented input match accented text
D.Splitting by syllable is enough in every case
Answer: C
Two things: diacritic normalization, because the same character can be encoded as a precomposed character or a base character plus a combining mark; and allowing unaccented input to find accented results, since that is a common user habit.
A field type must change in a running index. What is the correct approach?
A.Call the mapping update API with the new type
B.Create a new index, reload the data and switch the alias
C.Delete that field and add it again with the desired type
D.Overwrite every document with values of the new type
Answer: B
You must create a new index with the correct mapping, reindex the data, then switch the alias. The type of an existing field cannot be changed in place because the data in the index has already been written and encoded according to the old type.
What is the important property of Lucene segments?
A.They are modified directly whenever a document changes
B.They only exist in memory and are never written to disk
C.They are immutable once created, and an update writes a new version
D.Each index has exactly one segment
Answer: C
Segments are immutable once created. Updating a document is really writing a new version and marking the old one deleted, so the old version still occupies space until the segments are merged.
Why declare a field with both text and keyword forms?
A.Both full-text search and exact filtering and aggregation
B.It speeds up writing documents into the index
C.It saves space because the data is stored only once
D.It lets the field's type change without reindexing
Answer: A
The same data is indexed two ways: as text for full-text search, and as a keyword sub-field for exact filtering, sorting, and aggregation. The trade-off is a larger index because the content is stored twice.
How should data be synchronised from the primary database to Elasticsearch?
A.Rescan the whole table every few minutes
B.Query the database directly and index at search time
C.Push the changes through a queue and accept a short lag
D.Write to both at once inside one transaction
Answer: C
Push changes through a queue or a change-log reader process and accept a short delay. Writing to both places in a single transaction is not feasible, so the right model is eventual consistency with a way to detect drift.
What rule applies to heap allocation for an Elasticsearch node?
A.A fixed small value since Elasticsearch does not use much memory
B.Around half the machine's memory, with an upper cap
C.As large as possible, close to the machine's whole memory
D.No configuration is needed since the system tunes itself
Answer: B
Roughly half of the machine's memory, and below the compressed oops threshold, usually around thirty gigabytes. The other half is left for the OS to use as file system cache, which largely determines index read speed.
Which query type should be avoided on a large index?
A.A filter on a time range
B.A query matching several values from a list
C.A term match query on an indexed field
D.A wildcard query starting with an asterisk
Answer: D
A wildcard query starting with an asterisk forces the engine to scan nearly the whole term dictionary. Mid-string search needs should be solved with the right indexing at write time instead of being forced at query time.
A.The primary shards are all assigned but some replicas are not
B.Some data has been lost and cannot be recovered
C.The cluster is in the middle of a version upgrade
D.The disk is full so the cluster has gone read-only
Answer: A
Yellow means primary shards are all allocated but some replicas are not: data is complete and queries work normally, there is just no redundancy if a node is lost. Red means a primary shard is missing.
D.Split by time period and delete whole old indices
Answer: D
Split by time period, for example by day, then delete the whole old index once retention expires. Deleting an entire index is cheap, whereas deleting documents one by one by time condition is very expensive and leaves garbage waiting to be cleaned up.
A.Elasticsearch stores a pre-highlighted version of the document
B.The terms are marked when the document is written to the index
C.The client searches for the substring in the returned content
D.The server returns a snippet with tags wrapping the matching terms
Answer: D
The server returns snippets with tags wrapped around the matched terms, based on position information in the index. That way it highlights correctly even when words have been lowercased, had diacritics stripped, or been reduced to their root form.
A.A text field stores separate terms rather than the original string
B.A text field is not written to disk so it cannot be read back
C.A text field is always too long to compare
D.Sorting only supports numeric and date fields
Answer: A
Because a text field stores individual tokens after analysis, while sorting needs a single value per document. The correct approach is to sort on a keyword sub-field, which preserves the original string.
B.Transforming documents before they are written to the index
C.Compressing the data before writing it to disk
D.Transforming the results before returning them to the client
Answer: B
A pipeline transforms documents right before they are written: splitting strings into fields, normalising values, adding derived fields, enriching data. That way you don't have to change the sending application when the processing logic needs to change.
What problem do index templates solve when indices are created automatically?
A.Applying a mapping in advance to indices matching a name pattern
B.Deleting old indices automatically when their retention expires
C.Copying data between indices in the same group
D.Combining several indices into one for querying
Answer: A
Templates pre-apply mapping and settings to every index matching the name pattern. So a daily index created automatically at midnight still gets the right mapping, shard count, and alias with no manual intervention.
How do you make best-selling products rank higher in search results?
A.Repeat the product name several times in the title field
B.Put the best sellers into a separate index
C.Combine the relevance score with a business signal
D.Sort the results by units sold
Answer: C
Combine relevance score with business signals via a scoring adjustment mechanism: multiply or add based on popularity, sales, ratings. Sorting directly by sales will break keyword relevance.
C.Comparing the edit distance against terms present in the index
D.A pretrained language model
Answer: C
It compares the edit distance between the user's typed term and terms in the index. Because it only suggests terms that actually exist in the data, suggestions always lead to real results rather than a correctly spelled word with nothing behind it.
A.No backup is needed since the shards already have replicas
B.Copy each node's data directory somewhere else
C.Export every document to a file with a query
D.Use the snapshot mechanism into an external repository
Answer: D
Use snapshots to an external repository: they are incremental, consistent, and can restore index configuration too. Shard copies only protect against node loss, not accidental deletion or data corruption.
What is the biggest risk of exposing Elasticsearch to the internet?
A.Only public indices can be reached
B.The data is exposed but cannot be modified
C.Anyone can read and delete all the data
D.The cluster slows down from external queries
Answer: C
Data APIs and admin APIs share the same port, so anyone who can reach them can read, write, and delete every index. This is the cause of many data leaks from clusters exposed publicly without authentication.
How does the Elasticsearch slow log help with performance debugging?
A.It records queries exceeding a threshold along with their body
B.It measures the cluster's average response time
C.It automatically optimizes the slow queries
D.It blocks slow queries from running further
Answer: A
It logs queries that exceed a time threshold along with their actual content. With the content, you can reproduce and analyze them, instead of only seeing latency rise on a dashboard without knowing which query caused it.
How does a runtime field differ from an ordinary field?
A.It is stored after the first query
B.It takes no space in the index but costs at read time
C.It is faster than an ordinary field since it needs no disk read
D.It only works for numeric data
Answer: B
It does not take up space in the index because values are computed at query time, so adding a new field does not require reindexing. In exchange, every query must recompute it, costing more, and it is unsuitable for frequently used fields.
The number of primary shards is fixed after creation, because documents are distributed to shards based on that number. Changing it requires creating a new index and reindexing, which is why you should use an alias from the start.
